1. config policy，attach policy to IAM user or group.
2. root user login, and go to account page, then find 'IAM User and Role Access to Billing Information', then edit & activate access.
step 2 is not mentioned in IAM user manual.
refer:
https://aws.amazon.com/blogs/security/dont-forget-to-enable-access-to-the-billing-console/
