First you must go to your account settings and grant access to IAM users: https://console.aws.amazon.com/billing/home#/account

Click “edit”

And “activate”

 

Then you can go do all the policy group nonsense that every other google result will give you. Basically, just create a user and add them to a group with these policies:

 

Bosh.