Amazon Compute Optimizer and Amazon Organizations
Amazon Compute Optimizer is a service that analyzes the configuration and utilization metrics of your Amazon resources. Resource examples include Amazon Elastic Compute Cloud (Amazon EC2) instances and Auto Scaling groups. Compute Optimizer reports whether your resources are optimal and generates optimization recommendations to reduce the cost and improve the performance of your workloads. For more information about Compute Optimizer, see the Amazon Compute Optimizer User Guide.
Use the following information to help you integrate Amazon Compute Optimizer with Amazon Organizations.
Service-linked roles created when you enable integration
The following service-linked role is automatically created in your organization's management account when you enable trusted access. This role allows Compute Optimizer to perform supported operations within your organization's accounts in your organization.
You can delete or modify this role only if you disable trusted access between Compute Optimizer and Organizations, or if you remove the member account from the organization.
-
AWSServiceRoleForComputeOptimizer
Service principals used by the service-linked roles
The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by Compute Optimizer grant access to the following service principals:
-
compute-optimizer.amazonaws.com
Enabling trusted access with Compute Optimizer
For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.
You can enable trusted access using either the Amazon Compute Optimizer console or the Amazon Organizations console.
Important
We strongly recommend that whenever possible, you use the Amazon Compute Optimizer console or tools to enable integration with Organizations. This lets Amazon Compute Optimizer perform any configuration that it requires, such as creating resources needed by the service. Proceed with these steps only if you can’t enable integration using the tools provided by Amazon Compute Optimizer. For more information, see this note.
If you enable trusted access by using the Amazon Compute Optimizer console or tools then you don’t need to complete these steps.
To enable trusted access using the Compute Optimizer console
You must sign in to the Compute Optimizer console using your organization's management account. Opt-in on behalf of your organization by following the instructions at Opting in your Account in the Amazon Compute Optimizer User Guide.
You can enable trusted access by using either the Amazon Organizations console, by running a Amazon CLI command, or by calling an API operation in one of the Amazon SDKs.
Disabling trusted access with Compute Optimizer
For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.
Only an administrator in the Amazon Organizations management account can disable trusted access with Amazon Compute Optimizer.
You can disable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.
Enabling a delegated administrator account for Compute Optimizer
When you designate a member account to be a delegated administrator for the organization, users and roles from the designated account can manage the Amazon Web Services account metadata for other member accounts in the organization. If you don't enable a delegated admin account, then these tasks can be performed only by the organization's management account. This helps you to separate management of the organization from management of your account details.
Minimum permissions
Only a user or role in the Organizations management account can configure a member account as a delegated administrator for Compute Optimizer in the organization
For instructions about enabling a delegated administrator account for Compute Optimizer, see https://docs.amazonaws.cn/compute-optimizer/latest/ug/delegate-administrator-account.html in the Amazon Compute Optimizer User Guide.
Disabling a delegated administrator for Compute Optimizer
Only an administrator in the organization management account can configure a delegated administrator for Compute Optimizer.
To disable the delegated admin Compute Optimizer account using the Compute Optimizer console, see https://docs.amazonaws.cn/compute-optimizer/latest/ug/delegate-administrator-account.html in the Amazon Compute Optimizer User Guide.
To remove a delegated administrator using the Amazon Amazon CLI, see deregister-delegated-administrator in the Amazon Amazon CLI Command Reference.