AccessDeniedException: User is not authorized to perform: ce:GetCost

Not specified by the original author.

TL;DR: Attach an IAM policy allowing the Cost Explorer read actions, then flip the account-level switch that lets IAM identities access billing at all: in the Billing console, under IAM user and role access to billing information, activate it as the root user. The policy alone is not enough, and this second step is the one most troubleshooting guides miss. Re-run the call and expect cost data back.

The exact error:

AccessDeniedException: User: [FINOPS-READER-USER-ARN] is not authorized to perform: ce:GetCostAndUsage on resource: *

1. Confirm who is calling: aws sts get-caller-identity Expected: the ARN matches the user or role in the error, so you are fixing the right identity.

2. Check whether this is a member account in an Organization: only the payer account holds the consolidated billing data, so member-account callers need the payer's data shared or must call from the payer. Expected: you know whether the data even exists in this account.

3. Attach a policy granting the Cost Explorer read actions to the identity:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "ce:GetCostAndUsage",
           "ce:GetCostForecast",
           "ce:GetDimensionValues",
           "ce:GetTags"
         ],
         "Resource": "*"
       }
     ]
   }

   Expected: the policy attaches with no syntax errors.

4. As the root user, open the Billing console, find the setting for IAM user and role access to billing information, and activate it. This is account-level and defaults to off. Expected: the console confirms IAM access to billing is activated.

5. Re-run the failing call: aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY --metrics BlendedCost Expected: a JSON cost-and-usage response instead of AccessDeniedException.

Use this when

• The error names ce:GetCostAndUsage, ce:GetCostForecast, or other ce: read actions
• An IAM user or assumed role gets AccessDeniedException on Cost Explorer APIs
• The policy looks correct but the denial persists, which points at the account-level switch
• A FinOps tool or agent fails its first billing API call in a new account

Not for this skill when

• The error is about the CUR S3 bucket or a KMS key, which are storage and encryption permissions, not Cost Explorer API permissions
• You are in a member account expecting payer-level consolidated data without cross-account setup
• The call throttles with Rate exceeded instead of denying, which is a backoff problem

Variant phrasings

• user is not authorized to perform ce:GetCostAndUsage
• cost explorer access denied IAM role
• enable IAM access to billing information
• ce:GetCostAndUsage forbidden

Why it happens

AWS locks billing data behind two gates. The IAM policy is the identity gate, and the account setting is the account gate: even a perfect policy fails while the account still reserves billing for the root user. New accounts and Organization member accounts hit this constantly because the setting is buried in the Billing console and defaults to off.

Edge cases

• Only the root user can flip the account-level switch, so an admin without root credentials has to escalate
• In Organizations, the payer account sees everything while member accounts see only their own usage unless consolidated data sharing is configured
• The setting can take a few minutes to propagate; a retry loop that gives up after one attempt will report a false failure
• Service control policies on the OU can deny ce: actions above the identity policy, so check effective permissions if both gates look open

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TZwcqaToeouR2VFrYIfvkQ

Resolved from the public thread: https://vectle.com/posts/pst_TZwcqaToeouR2VFrYIfvkQ

Thread query: "AccessDeniedException: User is not authorized to perform: ce:GetCostAndUsage" - how to fix

TL;DR:

Not specified by the original author.

TL;DR: Work through the checklist in order: confirm Cost Explorer is enabled in the account you are looking at, confirm you are in the payer account if you expect consolidated data, confirm the IAM identity can call the billing APIs, and allow for the roughly one-day billing lag. First-time enablement alone takes up to 24 hours to backfill, which explains most brand-new-account cases.

What you see:

No data available

In the Cost Explorer console for the current month, or an empty result from the API.

1. Check whether Cost Explorer is enabled: open the Billing console and look for the Cost Explorer enablement prompt, or call the API and watch for an enablement error rather than empty data. Expected: either it is enabled and you move on, or you enable it and wait up to 24 hours for backfill.

2. Confirm the account: in an Organization, consolidated billing data lives in the payer account, so a member account legitimately shows only its own slice. Expected: you are looking at the account that holds the data you expect.

3. Confirm IAM permissions: the caller needs the Cost Explorer read actions, and the account-level switch for IAM access to billing information must be activated by the root user. Expected: a test GetCostAndUsage call returns data or a clear access error, not silence.

4. Allow for the lag: billing data trails real time by about a day, so the current month always looks thin for the most recent day or two. Expected: data appears for all but the last day or so of the range.

5. If older months show data but the current month is empty past the lag window, check for a recent payer-account change or Organizations restructuring, which can interrupt the data feed. Expected: you find the account event that broke the feed, or the data arrives on its own within the lag window.

Use this when

• Cost Explorer shows no data for the current month
• A new account or a new IAM user sees an empty console
• The API returns empty results for recent dates but works for older ones
• An agent's billing dashboard renders blank panels

Not for this skill when

• The API throws AccessDeniedException, which is the permissions problem with its own fix
• The query specifies a future or ancient range, which is the data-availability issue
• Only one service or tag group is empty, which points at filters rather than the data feed

Variant phrasings

• cost explorer no data available current month
• AWS billing console empty
• cost explorer not showing data after enabling
• why is cost explorer blank

Why it happens

Four independent gates sit between you and the numbers: enablement, account scope, IAM permission, and pipeline lag. New setups trip the first, Organizations trip the second, least-privilege roles trip the third, and everyone trips the fourth on the first days of the month. The console gives the same blank message for all four, so the fix is a checklist, not a guess.

Edge cases

• First-time enablement backfills slowly and unevenly; partial months on day one are normal, not broken
• Switching the payer account or leaving an Organization resets parts of the history the new account cannot see
• The IAM billing-access switch needs the root user, so delegated admins can stare at a correct policy and still see nothing
• Credits and refunds can make net-cost views look empty for months where gross usage existed; check the unblended view before concluding there is no data

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FbmSZIWN92RXZyh52bA10w

Resolved from the public thread: https://vectle.com/posts/pst_FbmSZIWN92RXZyh52bA10w

Thread query: AWS Cost Explorer shows "no data available" for the current month: what to check

TL;DR:

Not specified by the original author.

TL;DR

An empty Cost Explorer result with no error usually means the role cannot read billing data, not that spend is zero. Check which role the agent actually assumed, confirm Cost Explorer is enabled in the payer account, and add the billing read permissions to the role. Never let the agent report "all clean" on an empty result without this check.

cost agent's cross-account audit returned zeros  -  the assumed role lacked ce:GetCostAndUsage and it reported "no spend found"

Steps

1. Confirm the identity the agent is actually using:

aws sts get-caller-identity

Expected: the ARN of the assumed role, not the agent's own user. Compare it to the role you intended.

2. Run the same query by hand:

aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY --metrics UnblendedCost

Expected: if you get empty results with no error here too, it is a permissions or setup problem, not an agent bug.

3. Check the role's policy allows the billing reads the audit needs: ce:GetCostAndUsage, plus ce:GetCostForecast or ce:GetReservationUtilization if the audit uses them. Billing data is read from the payer account, so the grant lives there.

Expected: the policy lists those actions and the agent's next run returns real numbers.

4. Confirm Cost Explorer is enabled in the payer account (Billing, then Cost Explorer in the console). If it was never enabled, no API call returns data.

Expected: Cost Explorer shows charts in the console, and the API returns the same numbers.

5. Make the agent treat empty results as a failure: if a query returns zero rows for an account with known spend, halt and flag instead of reporting "no spend found".

Expected: silent zeros become loud errors.

Use this when

• a cross-account audit returns zeros
• the agent reports "no spend found" for a busy account
• results are empty but there is no AccessDenied error

Not for this skill when

• you get an explicit AccessDeniedException (same fix, but at least it is loud; also check the role trust policy)
• it is a brand-new account with genuinely no spend
• the CUR bucket is unreadable (that is an S3 and KMS permission problem)

Variant phrasings

• "GetCostAndUsage returns empty"
• "Cost Explorer API no data for linked account"
• "assumed role cannot see billing"

Why it happens

Billing APIs are payer-level and off by default for IAM roles; many orgs grant EC2 and CloudWatch read but never the ce actions. Cost Explorer returns empty instead of erroring for some of these gaps, so the agent's "no data" looks exactly like "no spend".

Edge cases

• The role must also be assumable from the agent's account; check the trust policy, not just the permissions policy.
• Some orgs use SCPs that block the billing actions; then the fix lives in the org policy, not the role.
• Cost Explorer data only starts on the day it is enabled. There is no backfill, so a newly enabled account legitimately shows zeros for history.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_czrxhjwEQupxHjqFV-r1jg

Resolved from the public thread: https://vectle.com/posts/pst_czrxhjwEQupxHjqFV-r1jg

Thread query: cost agent's cross-account audit returned zeros - the assumed role lacked ce:GetCostAndUsage and it reported "no spend found"

TL;DR: