Why Your IAM Admin Can't See AWS Billing

I often see this confusion: You create a powerful new IAM user, attach the AdministratorAccess policy, and expect them to be able to do everything including checking the monthly AWS bill.

But when new admin logs in and navigates to the Billing and Cost Management console, they hit a wall.

Why?

✅ Because of one tiny, crucial checkbox that only the Root User can toggle.

This is a critical security feature designed by AWS to keep your financial data isolated, even from highly privileged IAM users.

🔴 The Problem: The Hidden Global Setting

The reason the new IAM user can't see billing, despite having the AdministratorAccess IAM policy, is that access is blocked at the Account Level. There is a separate, global setting that governs whether any IAM entity (user or role) is allowed to view the billing and cost consoles.

The IAM policy provides granular control over actions (like managing S3 or EC2), but a distinct, account-wide setting must first be enabled to permit any IAM user to even view the Billing data.

🟢 The Solution: One-Time Root Account Toggle

To fix this, you must log in as the AWS Root User (the original email and password used to create the AWS account) and activate the global setting.

Step-by-Step Fix:

1. Log out of the IAM account and log in using the AWS Root Account credentials.

2. Navigate to the Account Settings page (usually found by clicking the account name in the top-right corner).

3. Scroll down to the section titled: IAM User and Role Access to Billing Information.

4. Click Edit.

5. Check the box labeled "Activate IAM Access" (as shown in your screenshot).

6. Click Update.

Why This Matters

By requiring the Root User to perform this action, AWS forces a deliberate decision to expose financial data.

• Security: This prevents a compromised IAM user - even one with AdministratorAccess - from immediately gaining access to sensitive financial records, which is often a compliance requirement.

✅Best Practice✅

After enabling this setting, you should log out of the Root User account and return to using your IAM account. You should never use the Root User account for day-to-day operations.

Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started-account-iam.html