Cost data access control decides who may see which cloud costs in how much detail, who may change budgets and exports, and who may spend money. All three providers separate these rights from the rights over resources, each in its own way: AWS through IAM actions and a switch per account, Azure through roles per scope and per agreement type, Google Cloud through roles on the billing account and on the project. Used well, it gives finance every cost without production access and every team its own cost without the whole invoice. The responsibilities behind it are covered in FinOps roles and responsibilities.
How it works
Four groups need different access. The table names, per provider, the narrowest route the documentation describes.
| Who | Needs | AWS | Azure | Google Cloud |
|---|---|---|---|---|
| Team owning cost | read the cost of its own area | its own member account with linked account access on, or a shared custom billing view | Cost Management Reader on a subscription or resource group | a project role with billing.resourceCosts.get, such as Project Viewer; for several projects, Project Billing Costs Manager |
| Finance and controlling | all costs, no resources | AWSBillingReadOnlyAccess in the management account, or a custom billing view | billing scope reader: EA enterprise administrator (read only), MCA reader | Billing Account Viewer |
| FinOps and platform | maintain budgets, exports and views | a customer managed policy with budgets and ce actions, plus the Data Exports actions | Cost Management Contributor, plus Storage Account Contributor for exports | Billing Account Costs Manager |
| Billing administration | payment methods, roles, settings | the Billing managed policy | EA enterprise administrator, MCA owner | Billing Account Administrator |
AWS
IAM users and roles cannot see the Billing console by default, even when their policies allow billing actions. The root user switches this on once per account with the Activate IAM Access setting; in member accounts created through AWS Organizations it is on from the start. What someone sees after that is governed by fine-grained IAM actions. The older aws-portal actions, such as aws-portal:ViewBilling, reached the end of standard support in July 2023; current policies name actions such as budgets:ModifyBudget or ce:CreateReport. As managed policies, AWS offers AWSBillingReadOnlyAccess for read-only access to the Billing console's features and Billing for viewing and editing, including budgets and payment methods.
In an organization the management account sees all costs and a member account only its own in Cost Explorer, a right the management account grants through linked account access to all member accounts or to none, with IAM refining it per user. For views across accounts, the management account defines custom billing views, filtered by accounts or cost allocation tags, and shares them with other accounts inside or outside the organization, where Cost Explorer and AWS Budgets use that data without anyone needing access to the management account. How Cost Explorer itself works is covered in Cost Explorer and AWS Budgets.
Azure
Azure separates RBAC scopes (management group, subscription, resource group) from billing scopes, which depend on the agreement. On RBAC scopes, Cost Management Reader can read costs and recommendations, and Cost Management Contributor can also manage budgets, exports, shared views and alerts; neither role shows invoices. On billing scopes the agreement's own roles apply, and their holders see the cost of the subscriptions beneath, but not the resources. For costs to be visible at all, an EA needs "DA view charges" on for departments and "AO view charges" on for account owners and RBAC scopes, and an MCA needs the "Azure charges" policy on the billing profile. Reservations and Marketplace purchases appear only at the billing scope; the scopes and roles in detail are covered in Azure Cost Management and Billing.
Google Cloud
On the billing account, Google grants Billing Account Viewer for cost information and transactions, Billing Account Costs Manager for budgets and for viewing and exporting cost information without pricing, and Billing Account Administrator for managing the account. Without a role on the billing account, a team sees a project's cost through billing.resourceCosts.get, which Project Owner, Editor and Viewer hold. That view stays limited to one project, without invoice-level charges, saved reports or grouping by label. For several projects, Google recommends Project Billing Costs Manager on the billing account; the role shows only projects the user can already see.
Setting up the usage export to BigQuery takes Billing Account Costs Manager or Administrator plus BigQuery User on the target project. Access to the dataset then decides who reads the data. An authorized view shares a subset, for example without certain columns, without access to the source table; readers need BigQuery Data Viewer on the view's dataset and BigQuery Job User on the project that runs the query.
Least privilege and review
Reading is the default, writing goes to whoever maintains budgets and exports, and buying is a right of its own that the cost governance policy settles. Exports deserve the same attention as roles. AWS Data Exports store their files in Amazon S3 and let you select columns and filter rows to remove sensitive cost information; Azure exports need a storage account. Whoever can read that storage can read the costs, regardless of any cost role.
All three providers have tools for review. AWS shows, through last accessed information, which services and actions an identity last used, so unused permissions can go. Microsoft Entra access reviews recertify group memberships and role assignments, Azure resource roles included, on a recurring schedule and require Microsoft Entra ID Governance or Microsoft Entra Suite, with some capabilities working on P2. Google derives role recommendations from at most 90 days of usage, for roles on organizations, folders, projects, buckets and BigQuery datasets. Billing accounts are not on that list, so their roles are reviewed by hand.
What it means for your cost
Access decides who can react. A team that cannot see its cost cannot own it, and a deviation then surfaces at month-end close rather than in the week it starts.
Each view shows a different slice of the invoice, as the provider sections show, so the sum of the team views does not equal the invoice. Reconciliation happens at the billing account, as reconciling exports with the invoice describes.
Where it goes wrong
- Policy attached, console empty. Symptom: a role with
AWSBillingReadOnlyAccesssees nothing in the Billing console. Cause: Activate IAM Access is off in that account, for example because it joined the organization rather than being created in it. - All or nothing. Symptom: after a settings change, every team loses cost data in its member account at once. Cause: linked account access applies to all member accounts together.
- Team totals against the invoice. Symptom: the sum of the team reports is below the invoice. Cause: team views contain no purchases made at the billing scope and no invoice-level charges.
- The export as a back door. Symptom: people without any cost role know the full costs. Cause: the export sits in a bucket, storage account or dataset whose permissions nobody reviews.
- Administrator for reading. Symptom: many people can manage the Google Cloud billing account. Cause: the administrator role was granted where Viewer or Costs Manager would have done, and role recommendations do not cover billing accounts.
Sources
Read on 2026-10-16. AWS managing access to the Billing console, IAM policies for AWS Cost Management, AWS managed policies for Billing, controlling access to Cost Explorer, Billing View, AWS Data Exports and last accessed information; Microsoft Cost Management scopes, assign access to Cost Management data and access reviews in Microsoft Entra; Google Cloud Cloud Billing access control, Cloud Billing reports, multi-project cost view access, set up the export to BigQuery, authorized views and role recommendations.