# Amazon Compute Optimizer and Amazon Organizations
<a name="services-that-can-integrate-compute-optimizer"></a>

Amazon Compute Optimizer is a service that analyzes the configuration and utilization metrics of your Amazon resources. Resource examples include Amazon Elastic Compute Cloud (Amazon EC2) instances and Auto Scaling groups. Compute Optimizer reports whether your resources are optimal and generates optimization recommendations to reduce the cost and improve the performance of your workloads. For more information about Compute Optimizer, see the [Amazon Compute Optimizer User Guide](https://docs.amazonaws.cn/compute-optimizer/latest/ug/what-is.html).

Use the following information to help you integrate Amazon Compute Optimizer with Amazon Organizations.



## Service-linked roles created when you enable integration
<a name="integrate-enable-slr-compute-optimizer"></a>

The following [service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/using-service-linked-roles.html) is automatically created in your organization's management account when you enable trusted access. This role allows Compute Optimizer to perform supported operations within your organization's accounts in your organization.

You can delete or modify this role only if you disable trusted access between Compute Optimizer and Organizations, or if you remove the member account from the organization.
+ `AWSServiceRoleForComputeOptimizer`
+ `AWSServiceRoleForComputeOptimizerAutomation`

## Service principals used by the service-linked roles
<a name="integrate-enable-svcprin-compute-optimizer"></a>

The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by Compute Optimizer grant access to the following service principals:
+ `compute-optimizer.amazonaws.com`

## Enabling trusted access with Compute Optimizer
<a name="integrate-enable-ta-compute-optimizer"></a>

For information about the permissions needed to enable trusted access, see [Permissions required to enable trusted access](orgs_integrate_services.md#orgs_trusted_access_perms).

You can enable trusted access using either the Amazon Compute Optimizer console or the Amazon Organizations console.

**Important**  
We strongly recommend that whenever possible, you use the Amazon Compute Optimizer console or tools to enable integration with Organizations. This lets Amazon Compute Optimizer perform any configuration that it requires, such as creating resources needed by the service. Proceed with these steps only if you can’t enable integration using the tools provided by Amazon Compute Optimizer. For more information, see [this note](orgs_integrate_services.md#important-note-about-integration).   
If you enable trusted access by using the Amazon Compute Optimizer console or tools then you don’t need to complete these steps.

**To enable trusted access using the Compute Optimizer console**  
You must sign in to the Compute Optimizer console using your organization's management account. Opt-in on behalf of your organization by following the instructions at [Opting in your Account](https://docs.amazonaws.cn/compute-optimizer/latest/ug/getting-started.html#account-opt-in) in the *Amazon Compute Optimizer User Guide*.

You can enable trusted access by using either the Amazon Organizations console, by running a Amazon CLI command, or by calling an API operation in one of the Amazon SDKs.

------
#### [ Amazon Web Services Management Console ]

**To enable trusted service access using the Organizations console**

1. Sign in to the [Amazon Organizations console](https://console.amazonaws.cn/organizations/v2). You must sign in as an IAM user, assume an IAM role, or sign in as the root user ([not recommended](https://docs.amazonaws.cn/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)) in the organization’s management account.

1. In the navigation pane, choose **Services**.

1. Choose **Amazon Compute Optimizer** in the list of services.

1. Choose **Enable trusted access**.

1. In the **Enable trusted access for Amazon Compute Optimizer** dialog box, type **enable** to confirm, and then choose **Enable trusted access**.

1. If you are the administrator of only Amazon Organizations, tell the administrator of Amazon Compute Optimizer that they can now enable that service to work with Amazon Organizations from the service console .

------
#### [ Amazon CLI, Amazon API ]

**To enable trusted service access using the OrganizationsCLI/SDK**  
Use the following Amazon CLI commands or API operations to enable trusted service access:
+ Amazon CLI: [enable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/enable-aws-service-access.html)

  Run the following command to enable Amazon Compute Optimizer as a trusted service with Organizations.

  ```
  $ aws organizations enable-aws-service-access \ 
      --service-principal compute-optimizer.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [EnableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_EnableAWSServiceAccess.html)

------

## Disabling trusted access with Compute Optimizer
<a name="integrate-disable-ta-compute-optimizer"></a>

For information about the permissions needed to disable trusted access, see [Permissions required to disable trusted access](orgs_integrate_services.md#orgs_trusted_access_disable_perms).

Only an administrator in the Amazon Organizations management account can disable trusted access with Amazon Compute Optimizer.

You can disable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.

------
#### [ Amazon CLI, Amazon API ]

**To disable trusted service access using the Organizations CLI/SDK**  
Use the following Amazon CLI commands or API operations to disable trusted service access:
+ Amazon CLI: [disable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/disable-aws-service-access.html)

  Run the following command to disable Amazon Compute Optimizer as a trusted service with Organizations.

  ```
  $ aws organizations disable-aws-service-access \
      --service-principal compute-optimizer.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [DisableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_DisableAWSServiceAccess.html)

------

## Enabling a delegated administrator account for Compute Optimizer
<a name="integrate-enable-da-compute-optimizer"></a>

When you designate a member account to be a delegated administrator for the organization, users and roles from the designated account can manage the Amazon Web Services account metadata for other member accounts in the organization. If you don't enable a delegated admin account, then these tasks can be performed only by the organization's management account. This helps you to separate management of the organization from management of your account details.

**Minimum permissions**  
Only a user or role in the Organizations management account can configure a member account as a delegated administrator for Compute Optimizer in the organization

For instructions about enabling a delegated administrator account for Compute Optimizer, see [https://docs.amazonaws.cn/compute-optimizer/latest/ug/delegate-administrator-account.html](https://docs.amazonaws.cn/compute-optimizer/latest/ug/delegate-administrator-account.html) in the *Amazon Compute Optimizer User Guide*.

------
#### [ Amazon CLI, Amazon API ]

If you want to configure a delegated administrator account using the Amazon CLI or one of the Amazon SDKs, you can use the following commands:
+ Amazon CLI: 

  ```
  $  aws organizations register-delegated-administrator \
      --account-id 123456789012 \
      --service-principal compute-optimizer.amazonaws.com
  ```
+ Amazon SDK: Call the Organizations `RegisterDelegatedAdministrator` operation and the member account's ID number and identify the account service principal `account.amazonaws.com` as parameters. 

------

## Disabling a delegated administrator for Compute Optimizer
<a name="integrate-disable-da-compute-optimizer"></a>

Only an administrator in the organization management account can configure a delegated administrator for Compute Optimizer.

 To disable the delegated admin Compute Optimizer account using the Compute Optimizer console, see [https://docs.amazonaws.cn/compute-optimizer/latest/ug/delegate-administrator-account.html](https://docs.amazonaws.cn/compute-optimizer/latest/ug/delegate-administrator-account.html) in the *Amazon Compute Optimizer User Guide*.

 To remove a delegated administrator using the Amazon Amazon CLI, see [deregister-delegated-administrator](https://docs.amazonaws.cn/cli/latest/reference/organizations/deregister-delegated-administrator.html) in the *Amazon Amazon CLI Command Reference*.