Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Billing Conductor

AWS Billing Conductor (service prefix: billingconductor) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Billing Conductor
Actions defined by AWS Billing Conductor
Resource types defined by AWS Billing Conductor
Condition keys for AWS Billing Conductor

API operations defined by AWS Billing Conductor

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateAccounts	billingconductor:AssociateAccounts	Write
AssociatePricingRules	billingconductor:AssociatePricingRules	Write
BatchAssociateResourcesToCustomLineItem	billingconductor:BatchAssociateResourcesToCustomLineItem	Write
BatchDisassociateResourcesFromCustomLineItem	billingconductor:BatchDisassociateResourcesFromCustomLineItem	Write
CreateBillingGroup	billingconductor:CreateBillingGroup	Write
CreateBillingGroup	billingconductor:TagResource	Tagging, Write
CreateCustomLineItem	billingconductor:CreateCustomLineItem	Write
CreateCustomLineItem	billingconductor:TagResource	Tagging, Write
CreatePricingPlan	billingconductor:CreatePricingPlan	Write
CreatePricingPlan	billingconductor:TagResource	Tagging, Write
CreatePricingRule	billingconductor:CreatePricingRule	Write
CreatePricingRule	billingconductor:TagResource	Tagging, Write
DeleteBillingGroup	billingconductor:DeleteBillingGroup	Write
DeleteCustomLineItem	billingconductor:DeleteCustomLineItem	Write
DeletePricingPlan	billingconductor:DeletePricingPlan	Write
DeletePricingRule	billingconductor:DeletePricingRule	Write
DisassociateAccounts	billingconductor:DisassociateAccounts	Write
DisassociatePricingRules	billingconductor:DisassociatePricingRules	Write
GetBillingGroupCostReport	billingconductor:GetBillingGroupCostReport	Read
ListAccountAssociations	billingconductor:ListAccountAssociations	List
ListAccountAssociations	organizations:ListAccounts	List
ListBillingGroupCostReports	billingconductor:ListBillingGroupCostReports	Read
ListBillingGroups	billingconductor:ListBillingGroups	Read
ListCustomLineItemVersions	billingconductor:ListCustomLineItemVersions	Read
ListCustomLineItems	billingconductor:ListCustomLineItems	Read
ListPricingPlans	billingconductor:ListPricingPlans	Read
ListPricingPlansAssociatedWithPricingRule	billingconductor:ListPricingPlansAssociatedWithPricingRule	List
ListPricingRules	billingconductor:ListPricingRules	Read
ListPricingRulesAssociatedToPricingPlan	billingconductor:ListPricingRulesAssociatedToPricingPlan	List
ListResourcesAssociatedToCustomLineItem	billingconductor:ListResourcesAssociatedToCustomLineItem	List
ListTagsForResource	billingconductor:ListTagsForResource	Read
TagResource	billingconductor:TagResource	Tagging, Write
UntagResource	billingconductor:UntagResource	Tagging, Write
UpdateBillingGroup	billingconductor:UpdateBillingGroup	Write
UpdateCustomLineItem	billingconductor:UpdateCustomLineItem	Write
UpdatePricingPlan	billingconductor:UpdatePricingPlan	Write
UpdatePricingRule	billingconductor:UpdatePricingRule	Write

Actions defined by AWS Billing Conductor

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateAccounts	Grants permission to associate between one and 30 accounts to a billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
AssociatePricingRules	Grants permission to associate pricing rules	pricingplan*	aws:ResourceTag/${TagKey}	Write
AssociatePricingRules	Grants permission to associate pricing rules	pricingrule*	aws:ResourceTag/${TagKey}	Write
BatchAssociateResourcesToCustomLineItem	Grants permission to batch associate resources to a percentage custom line item	customlineitem*	aws:ResourceTag/${TagKey}	Write
BatchDisassociateResourcesFromCustomLineItem	Grants permission to batch disassociate resources from a percentage custom line item	customlineitem*	aws:ResourceTag/${TagKey}	Write
CreateBillingGroup	Grants permission to create a billing group	pricingplan*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCustomLineItem	Grants permission to create a custom line item	billinggroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePricingPlan	Grants permission to create a pricing plan	pricingrule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePricingRule	Grants permission to create a pricing rule		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteBillingGroup	Grants permission to delete a billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
DeleteCustomLineItem	Grants permission to delete a custom line item	customlineitem*	aws:ResourceTag/${TagKey}	Write
DeletePricingPlan	Grants permission to delete a pricing plan	pricingplan*	aws:ResourceTag/${TagKey}	Write
DeletePricingRule	Grants permission to delete a pricing rule	pricingrule*	aws:ResourceTag/${TagKey}	Write
DisassociateAccounts	Grants permission to detach between one and 30 accounts from a billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
DisassociatePricingRules	Grants permission to disassociate pricing rules	pricingplan*	aws:ResourceTag/${TagKey}	Write
DisassociatePricingRules	Grants permission to disassociate pricing rules	pricingrule*	aws:ResourceTag/${TagKey}	Write
GetBillingGroupCostReport	Grants permission to view the billing group cost report for the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	Read
ListAccountAssociations	Grants permission to list the linked accounts of the payer account for the given billing period while also providing the billing group the linked accounts belong to			List
ListBillingGroupCostReports	Grants permission to view the billing group cost report			Read
ListBillingGroups	Grants permission to view the details of billing groups			Read
ListCustomLineItemVersions	Grants permission to view custom line item versions	customlineitem*	aws:ResourceTag/${TagKey}	Read
ListCustomLineItems	Grants permission to view custom line item details			Read
ListPricingPlans	Grants permission to view the pricing plans details			Read
ListPricingPlansAssociatedWithPricingRule	Grants permission to list pricing plans associated with a pricing rule	pricingrule*	aws:ResourceTag/${TagKey}	List
ListPricingRules	Grants permission to view pricing rules details			Read
ListPricingRulesAssociatedToPricingPlan	Grants permission to list pricing rules associated to a pricing plan	pricingplan*	aws:ResourceTag/${TagKey}	List
ListResourcesAssociatedToCustomLineItem	Grants permission to list resources associated to a percentage custom line item	customlineitem*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags of a resource	billinggroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
		customlineitem	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		pricingplan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		pricingrule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TagResource	Grants permission to tag a resource	billinggroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		customlineitem	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		pricingplan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		pricingrule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	billinggroup	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		customlineitem	aws:ResourceTag/${TagKey} aws:TagKeys
		pricingplan	aws:ResourceTag/${TagKey} aws:TagKeys
		pricingrule	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateBillingGroup	Grants permission to update a billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
UpdateCustomLineItem	Grants permission to update a custom line item	customlineitem*	aws:ResourceTag/${TagKey}	Write
UpdatePricingPlan	Grants permission to update a pricing plan	pricingplan*	aws:ResourceTag/${TagKey}	Write
UpdatePricingRule	Grants permission to update a pricing rule	pricingrule*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Billing Conductor

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
billinggroup	arn:${Partition}:billingconductor::${Account}:billinggroup/${BillingGroupId}	aws:ResourceTag/${TagKey}
customlineitem	arn:${Partition}:billingconductor::${Account}:customlineitem/${CustomLineItemId}	aws:ResourceTag/${TagKey}
pricingplan	arn:${Partition}:billingconductor::${Account}:pricingplan/${PricingPlanId}	aws:ResourceTag/${TagKey}
pricingrule	arn:${Partition}:billingconductor::${Account}:pricingrule/${PricingRuleId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Billing Conductor

AWS Billing Conductor defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Actions, resources, and condition keys

AWS Cloud Control API (cloudformation)