Audience: AWS Technical Owner
If you have received the below e-mail from AWS you have outdated CloudFormation stacks in one or more of your AWS accounts. If your AWS account owners/technical owners have not received this e-mail you may ignore this article.
Action Required: In order to make sure your Thoropass AWS connection remains healthy when AWS makes their change in December 2023, follow the instructions here for each of our AWS Connection Accounts on Thoropass to ensure your CloudFormation stacks are up to date.
If you still get communications from AWS warning you that you have retired actions after following the instructions above for each of your Thoropass AWS Connection Accounts, we recommend you follow the instructions here to ensure you have no unused/orphaned AWS CloudFormation stacks. These may be from Thoropass or another provider
E-Mail:
Hello,
Our records indicate that you are still using retired actions to access the AWS Billing, Cost Management, and Account consoles. AWS announced the retirement of IAM actions under the aws-portal service prefix, the purchase-orders:ViewPurchaseOrders and purchase-orders:ModifyPurchaseOrders actions on January 10, 2023, in favor of new fine-grained IAM actions. These new IAM actions provide you more control over access to the AWS Billing, Cost Management, and Account consoles.
To ensure you have continued access to our consoles, we are granting you a final extension until December 11, 2023, to migrate your policies to new actions. To help you with the migration, we have published a mapping between old and new actions in our user guide [1]. If you need to update policies across multiple member accounts in your organization, we have built bulk policy migration scripts to help you update all policies quickly and securely from your management account. See the bulk policy migration scripts user guide [2] for more information. You can find a detailed guide on how and which policies you need to update on our blog [3] and definitions of new IAM actions in Cost Management [4] and Billing [5] user guides.
Please update your policies before December 11, 2023, to ensure your users' access to the AWS Billing, Cost Management, and Account consoles is not affected. If you have more questions or need help making updates to your policies, please contact AWS support [6].
[1] Mapping fine-grained IAM actions reference - AWS Billing
[2] Use scripts to bulk migrate your policies to use fine-grained IAM actions - AWS Billing
[3] https://aws.amazon.com/blogs/aws-cloud-financial-management/changes-to-aws-billing-cost-management-and-account-consoles-permissions/
[4] https://docs.aws.amazon.com/cost-management/latest/userguide/migrate-granularaccess-whatis.html#migrate-user-permissions
[5] Migrating access control for AWS Billing - AWS Billing
[6] https://support.console.aws.amazon.com/support/home?#/
Sincerely,
Amazon Web Services