BLEA creates some sample IAM Roles that include deprecated IAM action `aws-portal:*Billing` that should be replaced equivalent policies.  https://aws.amazon.com/jp/blogs/news/changes-to-aws-billing-cost-management-and-account-consoles-permissions/ https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/migrate-granularaccess-iam-mapping-reference.html