# AWSFinOpsAgentServiceRolePolicy
**Description**: Provides AWS FinOps Agent access to billing, cost management, usage, optimization, and resource configuration capabilities to generate cost and savings insights, and allows it to manage its own Amazon EventBridge rules for configured workflows.
`AWSFinOpsAgentServiceRolePolicy` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
## Policy details
+ **Type**: Service-linked role policy
+ **Creation time**: October 20, 2026, 16:07 UTC
+ **Edited time:** October 20, 2026, 16:07 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSFinOpsAgentServiceRolePolicy`
## Policy version
**Policy version:** v1 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
## JSON policy document
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "CostExplorerReadAndAnalyzeAccess",
"Effect" : "Allow",
"Action" : [
"ce:DescribeCostCategoryDefinition",
"ce:GetAnomalies",
"ce:GetAnomalyMonitors",
"ce:GetCommitmentPurchaseAnalysis",
"ce:GetCostAndUsage",
"ce:GetCostAndUsageComparisons",
"ce:GetCostAndUsageWithResources",
"ce:GetCostCategories",
"ce:GetCostComparisonDrivers",
"ce:GetCostForecast",
"ce:GetDimensionValues",
"ce:GetReservationCoverage",
"ce:GetReservationPurchaseRecommendation",
"ce:GetReservationUtilization",
"ce:GetSavingsPlanPurchaseRecommendationDetails",
"ce:GetSavingsPlansCoverage",
"ce:GetSavingsPlansPurchaseRecommendation",
"ce:GetSavingsPlansUtilization",
"ce:GetSavingsPlansUtilizationDetails",
"ce:GetTags",
"ce:GetUsageForecast",
"ce:ListCommitmentPurchaseAnalyses",
"ce:ListCostAllocationTagBackfillHistory",
"ce:ListCostAllocationTags",
"ce:ListCostCategoryDefinitions",
"ce:ListCostCategoryResourceAssociations",
"ce:ListSavingsPlansPurchaseRecommendationGeneration",
"ce:ListTagsForResource",
"ce:StartCommitmentPurchaseAnalysis",
"ce:StartSavingsPlansPurchaseRecommendationGeneration"
],
"Resource" : "*"
},
{
"Sid" : "CostAndUsageReportReadAccess",
"Effect" : "Allow",
"Action" : [
"bcm-data-exports:GetExport",
"bcm-data-exports:ListExports",
"cur:DescribeReportDefinitions"
],
"Resource" : "*"
},
{
"Sid" : "BillingReadAccess",
"Effect" : "Allow",
"Action" : [
"billing:GetBillingData",
"billing:GetBillingDetails",
"billing:GetBillingNotifications",
"billing:GetBillingPreferences",
"billing:GetBillingView",
"billing:GetContractInformation",
"billing:GetCreditAllocationHistory",
"billing:GetCredits",
"billing:GetEnterpriseSupportChargeSummary",
"billing:GetEnterpriseSupportContractDetails",
"billing:GetIAMAccessPreference",
"billing:GetResourcePolicy",
"billing:GetSellerOfRecord",
"billing:ListBillingViews",
"billing:ListEnterpriseSupportLinkedAccountCharges",
"billing:ListSourceViewsForBillingView"
],
"Resource" : "*"
},
{
"Sid" : "BillingConductorReadAccess",
"Effect" : "Allow",
"Action" : [
"billingconductor:GetBillingGroupCostReport",
"billingconductor:ListAccountAssociations",
"billingconductor:ListBillingGroupCostReports",
"billingconductor:ListBillingGroups",
"billingconductor:ListCustomLineItemVersions",
"billingconductor:ListCustomLineItems",
"billingconductor:ListPricingPlans",
"billingconductor:ListPricingPlansAssociatedWithPricingRule",
"billingconductor:ListPricingRules",
"billingconductor:ListPricingRulesAssociatedToPricingPlan",
"billingconductor:ListResourcesAssociatedToCustomLineItem",
"billingconductor:ListTagsForResource"
],
"Resource" : "*"
},
{
"Sid" : "BudgetsReadAccess",
"Effect" : "Allow",
"Action" : [
"budgets:DescribeBudgetAction",
"budgets:DescribeBudgetActionHistories",
"budgets:DescribeBudgetActionsForAccount",
"budgets:DescribeBudgetActionsForBudget",
"budgets:ListTagsForResource",
"budgets:ViewBudget"
],
"Resource" : "*"
},
{
"Sid" : "InvoicingReadAccess",
"Effect" : "Allow",
"Action" : [
"invoicing:BatchGetInvoiceProfile",
"invoicing:GetInvoiceCorrection",
"invoicing:GetInvoiceEmailDeliveryPreferences",
"invoicing:GetInvoicePDF",
"invoicing:GetInvoiceUnit",
"invoicing:GetProcurementPortalPreference",
"invoicing:ListInvoiceCorrections",
"invoicing:ListInvoiceSummaries",
"invoicing:ListInvoiceUnits",
"invoicing:ListProcurementPortalPreferences",
"invoicing:ListProcurementPortalSuppliers",
"invoicing:ListProcurementPortals",
"invoicing:ListTagsForResource"
],
"Resource" : "*"
},
{
"Sid" : "PurchaseOrderReadAccess",
"Effect" : "Allow",
"Action" : [
"purchase-orders:GetPurchaseOrder",
"purchase-orders:ListPurchaseOrderInvoices",
"purchase-orders:ListPurchaseOrders",
"purchase-orders:ListTagsForResource",
"purchase-orders:ViewPurchaseOrders"
],
"Resource" : "*"
},
{
"Sid" : "FreeTierReadAccess",
"Effect" : "Allow",
"Action" : [
"freetier:GetAccountActivity",
"freetier:GetAccountPlanState",
"freetier:GetFreeTierAlertPreference",
"freetier:GetFreeTierUsage",
"freetier:ListAccountActivities"
],
"Resource" : "*"
},
{
"Sid" : "CreditProgramReadAccess",
"Effect" : "Allow",
"Action" : [
"mapcredits:ListAssociatedPrograms",
"mapcredits:ListQuarterCredits",
"mapcredits:ListQuarterSpend"
],
"Resource" : "*"
},
{
"Sid" : "PricingReadAccess",
"Effect" : "Allow",
"Action" : [
"pricing:DescribeServices",
"pricing:GetAttributeValues",
"pricing:GetProducts"
],
"Resource" : "*"
},
{
"Sid" : "PricingCalculatorReadAccess",
"Effect" : "Allow",
"Action" : [
"bcm-pricing-calculator:GetPreferences",
"bcm-pricing-calculator:GetWorkloadEstimate",
"bcm-pricing-calculator:ListWorkloadEstimateUsage",
"bcm-pricing-calculator:ListWorkloadEstimates"
],
"Resource" : "*"
},
{
"Sid" : "OrganizationStructureReadAccess",
"Effect" : "Allow",
"Action" : [
"account:GetRegionOptStatus",
"account:ListRegions",
"consolidatedbilling:GetAccountBillingRole",
"consolidatedbilling:ListLinkedAccounts",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:DescribeOrganizationalUnit",
"organizations:ListAWSServiceAccessForOrganization",
"organizations:ListAccounts",
"organizations:ListChildren",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListParents",
"organizations:ListRoots"
],
"Resource" : "*"
},
{
"Sid" : "AwsOrgsScopedAccess",
"Effect" : "Allow",
"Action" : [
"organizations:ListDelegatedAdministrators"
],
"Resource" : "*",
"Condition" : {
"StringLikeIfExists" : {
"organizations:ServicePrincipal" : [
"finops-agent.amazonaws.com"
]
}
}
},
{
"Sid" : "CostOptimizationHubReadAccess",
"Effect" : "Allow",
"Action" : [
"cost-optimization-hub:GetPreferences",
"cost-optimization-hub:GetRecommendation",
"cost-optimization-hub:ListEfficiencyMetrics",
"cost-optimization-hub:ListEnrollmentStatuses",
"cost-optimization-hub:ListRecommendationSummaries",
"cost-optimization-hub:ListRecommendations"
],
"Resource" : "*"
},
{
"Sid" : "ComputeOptimizerReadAccess",
"Effect" : "Allow",
"Action" : [
"compute-optimizer:DescribeRecommendationExportJobs",
"compute-optimizer:GetAutoScalingGroupRecommendations",
"compute-optimizer:GetEBSVolumeRecommendations",
"compute-optimizer:GetEC2InstanceRecommendations",
"compute-optimizer:GetEC2RecommendationProjectedMetrics",
"compute-optimizer:GetECSServiceRecommendationProjectedMetrics",
"compute-optimizer:GetECSServiceRecommendations",
"compute-optimizer:GetEffectiveRecommendationPreferences",
"compute-optimizer:GetEnrollmentStatus",
"compute-optimizer:GetEnrollmentStatusesForOrganization",
"compute-optimizer:GetIdleRecommendations",
"compute-optimizer:GetLambdaFunctionRecommendations",
"compute-optimizer:GetLicenseRecommendations",
"compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics",
"compute-optimizer:GetRDSDatabaseRecommendations",
"compute-optimizer:GetRecommendationPreferences",
"compute-optimizer:GetRecommendationSummaries"
],
"Resource" : "*"
},
{
"Sid" : "CostOptimizationAutomationReadAccess",
"Effect" : "Allow",
"Action" : [
"aco-automation:GetAutomationEvent",
"aco-automation:GetAutomationRule",
"aco-automation:GetEnrollmentConfiguration",
"aco-automation:ListAccounts",
"aco-automation:ListAutomationEventSteps",
"aco-automation:ListAutomationEventSummaries",
"aco-automation:ListAutomationEvents",
"aco-automation:ListAutomationRulePreview",
"aco-automation:ListAutomationRulePreviewSummaries",
"aco-automation:ListAutomationRules",
"aco-automation:ListRecommendedActionSummaries",
"aco-automation:ListRecommendedActions",
"aco-automation:ListTagsForResource"
],
"Resource" : "*"
},
{
"Sid" : "SavingsPlansReadAccess",
"Effect" : "Allow",
"Action" : [
"savingsplans:DescribeSavingsPlanRates",
"savingsplans:DescribeSavingsPlans",
"savingsplans:DescribeSavingsPlansOfferingRates",
"savingsplans:DescribeSavingsPlansOfferings",
"savingsplans:ListTagsForResource"
],
"Resource" : "*"
},
{
"Sid" : "ComputeResourceReadAccess",
"Effect" : "Allow",
"Action" : [
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScalingPolicies",
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeAutoScalingInstances",
"ec2:DescribeAddresses",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeNatGateways",
"ec2:DescribeReservedInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpoints"
],
"Resource" : "*"
},
{
"Sid" : "LambdaResourceReadAccess",
"Effect" : "Allow",
"Action" : [
"lambda:GetFunctionConfiguration",
"lambda:ListFunctions",
"lambda:ListProvisionedConcurrencyConfigs"
],
"Resource" : "*"
},
{
"Sid" : "ContainerResourceReadAccess",
"Effect" : "Allow",
"Action" : [
"ecs:ListClusters",
"ecs:ListServices"
],
"Resource" : "*"
},
{
"Sid" : "DatabaseResourceReadAccess",
"Effect" : "Allow",
"Action" : [
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeTable",
"dynamodb:ListTables",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeReplicationGroups",
"elasticache:DescribeReservedCacheNodes",
"elasticache:DescribeSnapshots",
"memorydb:DescribeClusters",
"memorydb:DescribeSnapshots",
"rds:DescribeDBClusterSnapshots",
"rds:DescribeDBClusters",
"rds:DescribeDBEngineVersions",
"rds:DescribeDBInstances",
"rds:DescribeDBSnapshots",
"rds:DescribeReservedDBInstances",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeClusters",
"redshift:DescribeReservedNodes"
],
"Resource" : "*"
},
{
"Sid" : "StorageResourceReadAccess",
"Effect" : "Allow",
"Action" : [
"s3:GetBucketLocation",
"s3:GetBucketVersioning",
"s3:GetIntelligentTieringConfiguration",
"s3:GetInventoryConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetReplicationConfiguration",
"s3:GetStorageLensConfiguration",
"s3:ListAllMyBuckets"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "MachineLearningResourceReadAccess",
"Effect" : "Allow",
"Action" : [
"sagemaker:DescribeEndpoint",
"sagemaker:DescribeEndpointConfig",
"sagemaker:DescribeNotebookInstance",
"sagemaker:ListApps",
"sagemaker:ListDomains",
"sagemaker:ListEndpointConfigs",
"sagemaker:ListEndpoints",
"sagemaker:ListNotebookInstances"
],
"Resource" : "*"
},
{
"Sid" : "WorkspacesReadAccess",
"Effect" : "Allow",
"Action" : [
"workspaces:DescribeWorkspaces",
"workspaces:DescribeWorkspacesConnectionStatus"
],
"Resource" : "*"
},
{
"Sid" : "ResourceDiscoveryReadAccess",
"Effect" : "Allow",
"Action" : [
"ram:GetResourceShares",
"resource-explorer-2:GetIndex",
"resource-explorer-2:ListIndexes",
"resource-explorer-2:Search",
"tag:GetResources"
],
"Resource" : "*"
},
{
"Sid" : "UtilizationMetricsReadAccess",
"Effect" : "Allow",
"Action" : [
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource" : "*"
},
{
"Sid" : "LogConfigurationReadAccess",
"Effect" : "Allow",
"Action" : [
"logs:DescribeLogGroups",
"logs:DescribeSubscriptionFilters"
],
"Resource" : "*"
},
{
"Sid" : "CloudTrailConfigurationReadAccess",
"Effect" : "Allow",
"Action" : [
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetTrailStatus",
"cloudtrail:LookupEvents"
],
"Resource" : "*"
},
{
"Sid" : "HealthEventReadAccess",
"Effect" : "Allow",
"Action" : [
"health:DescribeEvents"
],
"Resource" : "*"
},
{
"Sid" : "EventBridgeManagedRuleManagementWritePermissions",
"Effect" : "Allow",
"Action" : [
"events:DeleteRule",
"events:DisableRule",
"events:EnableRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets"
],
"Resource" : "arn:aws:events:*:*:rule/*",
"Condition" : {
"StringEquals" : {
"events:ManagedBy" : "finops-agent.amazonaws.com"
}
}
},
{
"Sid" : "EventBridgeManagedRuleManagementReadPermissions",
"Effect" : "Allow",
"Action" : [
"events:DescribeRule",
"events:ListTargetsByRule"
],
"Resource" : "arn:aws:events:*:*:rule/*"
}
]
}
```
## Learn more
+ [Understand versioning for IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)