Giving Your IAM Users a View Into Billing (Without Handing Out the Keys)

By default, your IAM users can log in, do their work, and never see a single dollar of what your AWS account is costing. Fixing that takes exactly one Root account login and one toggle — here's how to do it, and what to know before you flip it.

The Billing Blind Spot Nobody Warns You About

Here's something that surprises a lot of people the first time they set up an IAM user in AWS: that user can have full permissions to spin up EC2 instances, manage S3 buckets, and touch half the services in the console, and still have zero visibility into what any of it costs. Billing and budget information is walled off from IAM users by default, full stop, regardless of what other permissions you've granted them.

That's not a bug. It's AWS being conservative about a category of data that's genuinely sensitive — payment methods, invoices, spend history. But it creates a real practical problem if you're the one actually using that IAM user day to day. You want to keep an eye on costs. You want to see the budget dashboard. And right now, you can't, because the account is set up to keep that information locked to the Root user only.

So this next step in the setup process is about closing that gap: turning on a specific setting that lets IAM users see billing information, using the same account we've been configuring MFA on. It's a small change, but it's one of those settings that's tucked away enough that you'd never stumble onto it by accident.

Why This One Requires Root

This is a good moment to talk about something that's easy to gloss over: this setting can only be changed from the Root account. Not an IAM user with administrator access, not a role — Root, specifically.

If you've been following along with account setup, you should already have MFA configured on Root from an earlier step. That's exactly what we're going to use here. Log into Root the same way you did when you set up that multi-factor authentication, entering your code from your authenticator app as the second step after your password.

I want to be upfront about why this matters: logging into Root should be a rare occurrence, not a habit. AWS's own guidance is pretty blunt about this — Root has unrestricted access to everything in the account, including the ability to close the account entirely, change support plans, and access billing data with no guardrails. There's no permissions boundary you can put around it. That's exactly why the setup process for this whole series has been steering you toward doing almost everything through IAM, and toward Root only for the handful of things that genuinely require it — like the setting we're changing here.

So take this as a deliberate, bounded task: log in, make one specific change, log back out. Don't use this session to poke around other Root-only settings while you're in there, and don't save Root credentials anywhere convenient for next time. The whole point of having MFA on this account is that logging in should be a little bit of friction — that's a feature, not an inconvenience. Realistically, once this setting is enabled, you may not need to come back to Root again for a long while.

Finding the Toggle

Once you're logged into Root, the path to this setting is a few clicks. Click on your account name in the top-right corner of the console — this opens the account menu — and select Account from the dropdown. That takes you to the Account settings page, which is a fairly long page with a mix of contact information, payment settings, and a handful of security-related toggles further down.

Scroll down until you find the section labeled something like IAM user and role access to billing information. By default, this is turned off, which is exactly the state that's been keeping your IAM user locked out of billing data up to this point. Enable it, and confirm the change if the console asks you to.

That's genuinely the whole mechanical part of the task. It's a single toggle, not a multi-step wizard. If your console looks a little different from what I'm describing — the layout has moved things around, or the setting is labeled slightly differently — that's worth double-checking against AWS's current documentation rather than assuming it's been removed. Console UIs shift over time, and the exact click path is one of those things that ages faster than the underlying concept.

Before You Flip the Switch: Know Who Actually Gets Access

Here's the part that's easy to skim past but genuinely matters: this setting is not scoped to one user. When you enable IAM user access to billing information, you're granting that visibility to every IAM user and role in the account — not just the one you've been setting up in this series.

In a lot of setups, especially early on when you might only have one or two IAM users, that's a non-issue; you probably want you to see billing information. But if you're doing this in an account that already has multiple IAM users — say, a shared team account, or one where you've created separate users for different collaborators or automated processes — this toggle opens billing visibility to all of them at once. There's no finer-grained switch here that lets you say "this user can see billing, this one can't." It's an all-or-nothing setting at the account level.

If you do need more granular control — letting specific users see billing data while keeping it from others — that's a job for IAM policies attached to individual users or roles, layered on top of this account-level toggle rather than instead of it. But for the purposes of this setup, where we're working with a single IAM user, flipping this on is exactly what unlocks the visibility we're after. Just go in knowing what the switch actually does before you touch it, especially if this account will end up with more users down the road.

Logging Back Out

Once the toggle is on, the task is done. Log back out of the Root account the same way you'd log out of anything else — and treat this as the point where Root goes back in the drawer.

This is worth sitting with for a second, because it's easy to treat account setup as a series of interchangeable steps, but this one's different in kind. Everything else in this process — creating IAM users, assigning permissions, setting up MFA on those users — happens in contexts you're meant to use regularly. Root is the opposite. The ideal outcome of a well-configured AWS account is that you almost never need to log into Root again. If you've set up IAM users with the right permissions, and now those users can see the billing information they need, there's not much left that requires Root-level access on a routine basis.

So this really might be the last time you need to log into this account for a good while. That's the goal, not a coincidence. If you find yourself reaching for Root regularly going forward, it's usually a sign that something in the IAM permission structure needs adjusting rather than a reason to keep using Root as a workaround.

Conclusion

With billing visibility enabled, your IAM user now has a complete enough picture to actually operate day to day — permissions to do the work, and now visibility into what that work costs. If you haven't already, it's worth logging back in as your IAM user and confirming the billing dashboard actually shows up before you consider this step finished.