> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudcapital.co/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM Policy Check

> Before Cloud Capital sends your AWS Billing Transfer invite, complete this quick check to confirm your IAM policies are compatible. Takes 5 minutes and prevents delays during onboarding.

Your Cloud Capital contact has sent you this page as part of your onboarding. **Complete this check before they send your AWS Billing Transfer invite.** If you find and fix any issues now, your billing transfer will go through smoothly — if issues are found only after the invite is accepted, you'll need to fix them before data can flow and re-attempt the transfer.

<Info>
  **Most accounts are unaffected.** If your AWS account or organization was created **on or after March 6, 2023**, you can skip straight to [verifying you're not affected](#check-your-affected-policies) — the tool will confirm this in seconds.
</Info>

***

## Why this check exists

AWS retired a set of legacy IAM actions (`aws-portal:*`) used to control access to Billing and Cost Management. If your AWS account was created before March 6, 2023, some of your IAM policies may still reference these old actions — and AWS Billing Transfer requires the newer fine-grained permissions to work correctly.

The good news: AWS provides a free tool that scans your policies and tells you exactly what (if anything) needs to change, with suggested fixes ready to copy.

***

## Check your affected policies

<Steps>
  <Step title="Sign in to your AWS management (payer) account">
    For the tool to show issues across your entire AWS Organization, sign in as a role or user with **Organizational level access in your management (payer) account** — organization admin or root access to that account works best so you can see all possible issues across the organization instead of just going account by account.

    If you only have access to a single member account, the tool will still show issues for that account.
  </Step>

  <Step title="Open the Affected Policies tool">
    Go directly to the tool:

    **[https://console.aws.amazon.com/poliden/home?region=us-east-1#/](https://console.aws.amazon.com/poliden/home?region=us-east-1#/)**

    This is AWS's built-in IAM policy migration tool under Billing preferences. You may be prompted to sign in if you're not already.
  </Step>

  <Step title="Review the results">
    The tool will either show:

    **✅ No policies listed** — You're all set. No action is required. Let your Cloud Capital contact know you're clear to receive the billing transfer invite.

    **⚠️ One or more policies listed** — Each entry shows the policy name, the deprecated actions it contains, and a suggested updated policy you can copy directly. Follow the [migration steps below](#fixing-affected-policies) to resolve them, then return here to confirm the list is empty.
  </Step>
</Steps>

<Tip>
  The tool scans **IAM identity-based policies** only — not Service Control Policies (SCPs). If your organization uses SCPs to restrict billing access, review those separately. See the [FAQ below](#frequently-asked-questions) for details.
</Tip>

***

## Fixing affected policies

If the Affected Policies tool listed one or more policies, follow the steps below to update them. Come back to the tool afterward to confirm the list is empty, then let your Cloud Capital contact know you're ready.

<Tabs>
  <Tab title="Using the Affected Policies Tool (recommended)">
    The tool generates an updated version of each affected policy — you don't need to hand-write the new actions.

    <Steps>
      <Step title="Copy the updated policy">
        In the **[Affected Policies tool](https://console.aws.amazon.com/poliden/home?region=us-east-1#/)**, find the policy you want to update. Under the **Copy updated policy** column, click **Copy**.

        The copied policy includes your existing statements *plus* a new block (prefixed `AffectedPoliciesMigrator`) with the equivalent fine-grained actions.
      </Step>

      <Step title="Open the policy in IAM">
        Navigate to [IAM → Policies](https://console.aws.amazon.com/iam/home#/policies), search for the policy by name, and click into it.
      </Step>

      <Step title="Edit and paste the updated policy">
        Click **Edit policy** → switch to the **JSON** tab → replace the existing policy document with the one you copied → click **Review policy** → **Save changes**.
      </Step>

      <Step title="Repeat for all affected policies">
        Return to the Affected Policies tool and repeat this process for each policy listed.
      </Step>

      <Step title="Verify the migration is complete">
        Refresh the Affected Policies tool. If the list is now empty, you're done — let your Cloud Capital contact know.
      </Step>
    </Steps>

    <Warning>
      **Keep the old `aws-portal:*` actions in place during migration.** The updated policy generated by the tool retains them alongside the new fine-grained actions. This ensures continuity of access while the deprecation completes.
    </Warning>
  </Tab>

  <Tab title="Bulk Policy Migrator (AWS Organizations)">
    If you manage an **AWS Organization with multiple member accounts**, the Bulk Policy Migrator lets you scan and fix all accounts in one pass from your management account.

    <Steps>
      <Step title="Open the Bulk Policy Migrator">
        In your management (payer) account, navigate to the AWS Billing console. In the left navigation, go to **Billing preferences** → **Bulk Policy Migrator**.

        If you don't see this option, search for **"Bulk Policy Migrator"** in the AWS console search bar.
      </Step>

      <Step title="Select Customize mode">
        Choose **Customize** to review which member accounts are affected before applying changes.
      </Step>

      <Step title="Review and migrate">
        The tool lists any member accounts with affected policies. For each, review the recommended changes and click **Migrate** to apply them. The migrator adds the new actions alongside the existing ones — it does not remove the old ones, so access is not interrupted.
      </Step>

      <Step title="Verify completion">
        After applying all migrations, return to the Bulk Policy Migrator overview. If the affected accounts list is empty, you're done.

        You can also cross-check using the **[Affected Policies tool](https://console.aws.amazon.com/poliden/home?region=us-east-1#/)** directly.
      </Step>
    </Steps>

    <Note>
      The Bulk Policy Migrator typically takes **5–15 minutes** for most organizations.
    </Note>
  </Tab>

  <Tab title="Updating policies in code (IaC)">
    If your IAM policies are managed via Terraform, CloudFormation, CDK, or version-controlled JSON/YAML, update those definitions as well — not just the console.

    Use the [AWS old-to-new action mapping reference](https://docs.aws.amazon.com/cost-management/latest/userguide/migrate-granularaccess-whatis.html) to identify the fine-grained equivalents for each `aws-portal:*` action.

    A typical before/after:

    ```json Before (legacy) theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "ViewBillingAccess",
          "Effect": "Allow",
          "Action": [
            "aws-portal:ViewBilling",
            "aws-portal:ViewPaymentMethods"
          ],
          "Resource": "*"
        }
      ]
    }
    ```

    ```json After (fine-grained) theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "ViewBillingAccess",
          "Effect": "Allow",
          "Action": [
            "aws-portal:ViewBilling",
            "aws-portal:ViewPaymentMethods"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AffectedPoliciesMigratorViewBillingAccess",
          "Effect": "Allow",
          "Action": [
            "billing:GetBillingData",
            "billing:GetBillDetails",
            "billing:GetConsoleActionSetEnforced",
            "payments:ListPaymentPreferences",
            "payments:GetPaymentInstrument"
          ],
          "Resource": "*"
        }
      ]
    }
    ```

    <Note>
      The exact fine-grained actions that map to your existing permissions will vary. Use the [Affected Policies Tool](https://console.aws.amazon.com/poliden/home?region=us-east-1#/) output as your authoritative reference — it generates the correct replacement actions for each specific policy.
    </Note>

    After deploying your IaC changes, confirm via the Affected Policies tool that the list is now empty.
  </Tab>
</Tabs>

***

## Frequently asked questions

<AccordionGroup>
  <Accordion title="My account was created after March 6, 2023. Do I need to do anything?">
    No — accounts created on or after that date already enforce fine-grained actions by default. The Affected Policies tool will show an empty list, confirming you're ready to proceed. Just let your Cloud Capital contact know.
  </Accordion>

  <Accordion title="Will my team lose access during the migration?">
    No — as long as you retain the old `aws-portal:*` actions in your policy during the transition, access remains uninterrupted. The migration adds new fine-grained actions alongside the existing ones; it does not remove the old ones.
  </Accordion>

  <Accordion title="I manage multiple AWS accounts. Do I need to do this for each one?">
    No — use the **Bulk Policy Migrator** in your management (payer) account. It scans all member accounts at once and lets you apply recommended migrations in Customize mode. See the Bulk Policy Migrator tab above for step-by-step instructions.
  </Accordion>

  <Accordion title="Does this affect Service Control Policies (SCPs)?">
    The Affected Policies tool only scans **IAM identity-based policies**. SCPs are not included. If your organization uses SCPs to restrict billing or cost management access, review those separately using the [AWS action mapping reference](https://docs.aws.amazon.com/cost-management/latest/userguide/migrate-granularaccess-whatis.html).
  </Accordion>

  <Accordion title="What happens if I don't complete this before the billing transfer invite?">
    You may encounter permission errors when accepting the invite, or cost and billing data may not flow through correctly after onboarding. Completing this check first ensures the transfer goes through without interruption.
  </Accordion>
</AccordionGroup>

***

## All clear? Let your Cloud Capital contact know

Once the Affected Policies tool shows an empty list, you're ready for the billing transfer invite. Reach out to your Cloud Capital contact and they'll send it right away.

<CardGroup cols={2}>
  <Card title="AWS Affected Policies Tool" icon="shield-check" href="https://console.aws.amazon.com/poliden/home?region=us-east-1#/">
    Open the tool directly to check your IAM policies.
  </Card>

  <Card title="AWS fine-grained permissions reference" icon="book" href="https://docs.aws.amazon.com/cost-management/latest/userguide/migrate-security-iam-tool.html">
    Official AWS documentation on the Affected Policies Tool.
  </Card>
</CardGroup>