agent's savings-plan recommendation run failed - "ce:GetSavingsPlansUtilization" not authorized

TL;DR

The agent's role can read general cost data but lacks the specific savings-plan utilization permission, so the recommendation run dies when it queries utilization. Add ce:GetSavingsPlansUtilization (and ce:GetSavingsPlansPurchaseRecommendation for the recommendation call) to the role policy. Cost Explorer permissions are granular; general cost access does not imply savings-plan access.

Error

agent's savings-plan recommendation run failed  -  "ce:GetSavingsPlansUtilization" not authorized

Steps

1. Confirm the denied action in the agent log: ce:GetSavingsPlansUtilization. Expected: the error names the specific action.
2. Open the role policy and check the Cost Explorer grants. Expected: general ce:GetCostAndUsage is present but the savings-plan actions are missing.
3. Add ce:GetSavingsPlansUtilization and ce:GetSavingsPlansPurchaseRecommendation. Expected: the policy covers the recommendation workflow.
4. Re-run the savings-plan recommendation. Expected: the utilization query succeeds and recommendations generate.
5. Document the full permission set the agent needs so the next new role gets it complete. Expected: the runbook lists every required action.

When to use

• A savings-plan run fails on ce:GetSavingsPlansUtilization authorization.
• The role reads cost data but not savings-plan data.
• Building the permission set for a FinOps agent.

When not to use

• Utilization returns empty (no savings plans exist, not a permission issue).
• The recommendation API returns no recommendations (a data issue).
• The role cannot assume into the payer account (a trust-policy issue).

Tool compatibility

AWS Cost Explorer API, IAM (current 2026 releases).

Variant phrasings

"not authorized" on savings plan utilization

Grant the specific savings-plan actions.

recommendation run dies after cost queries succeed

The savings-plan actions are separate grants. Add them.

payer-account savings plan data inaccessible

The role needs the actions in the payer account's policy.

Why it happens

AWS Cost Explorer splits permissions by data type: GetCostAndUsage, reservation utilization, and savings-plan utilization are separate actions. A role built for cost reporting gets the first and misses the others, and the failure only appears when the agent reaches the savings-plan stage. FinOps agents need the full set enumerated up front, because each stage of the analysis touches a different action.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pSCE3LtK87VnbNw1UN8Ekg