# EC2 Capacity Manager and Amazon Organizations
<a name="services-that-can-integrate-ec2-capacity-manager"></a>

EC2 Capacity Manager is a new UI experience with accompanying APIs for you to aggregate, view, analyze, and manage your capacity usage across EC2 On-Demand, Spot, and Capacity Reservations. When you grant trusted access for EC2 Capacity Manager to your Amazon Organization, the service gains permission to read organization membership information across all member accounts. Specifically, Capacity Manager performs the following actions in member accounts: it collects EC2 usage data (including on-demand instances, spot instances, and capacity reservations) from all member accounts to aggregate into organization-wide capacity reports and dashboards. The service does not modify resources or configurations in member accounts - it only reads usage telemetry data that is already collected by Amazon. This allows organization administrators to view consolidated capacity utilization, forecast future needs, and optimize resource allocation across their entire organization from a single dashboard. For more information, see [EC2 Capacity Manager](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/capacity-manager.html) in the *Amazon EC2 User Guide*. 

Use the following information to help you integrate EC2 Capacity Manager with Amazon Organizations.



## Service-linked roles created when you enable integration
<a name="integrate-enable-slr-ec2-capacity-manager"></a>

The following [service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/using-service-linked-roles.html) is automatically created in your organization's management account when you enable trusted access. This role allows EC2 Capacity Manager to perform supported operations within your organization's accounts in your organization.

You can delete or modify this role only if you disable trusted access between EC2 Capacity Manager and Organizations, or if you remove the member account from the organization.

The following service-linked role is created in the management account when you enable trusted access. This role allows EC2 Capacity Manager to perform tasks in your organization and its accounts on your behalf.

You can delete or modify this role only if you disable trusted access between EC2 Capacity Manager and Amazon Organizations, or if you remove the member account from the organization. For more information, see [Using service-linked roles for EC2 Capacity Manager](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/using-service-linked-roles-cm.html) and [Amazon managed policy: AWSEC2CapacityManagerServiceRolePolicy](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-AWSEC2CapacityManagerServiceRolePolicy) in the *Amazon EC2 User Guide*.
+ `AWSServiceRoleForEC2CapacityManager` – Allows EC2 Capacity Manager to access Amazon services and resources used or managed by EC2 Capacity Manager on your behalf.

## Service principals used by EC2 Capacity Manager
<a name="integrate-enable-svcprin-ec2-capacity-manager"></a>

The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by EC2 Capacity Manager grant access to the following service principals:
+ `ec2.capacitymanager.amazonaws.com`

## Enabling trusted access with EC2 Capacity Manager
<a name="integrate-enable-ta-ec2-capacity-manager"></a>

For information about the permissions needed to enable trusted access, see [Permissions required to enable trusted access](orgs_integrate_services.md#orgs_trusted_access_perms).

When you grant trusted access for EC2 Capacity Manager to your Amazon Organization, the service gains permission to read organization membership information across all member accounts. This allows organization administrators to view consolidated capacity utilization, forecast future needs, and optimize resource allocation across their entire organization from a single dashboard. 

You can enable trusted access using either the EC2 Capacity Manager console or the Amazon Organizations console.

**Important**  
We strongly recommend that whenever possible, you use the EC2 Capacity Manager console or tools to enable integration with Organizations. This lets EC2 Capacity Manager perform any configuration that it requires, such as creating resources needed by the service. Proceed with these steps only if you can’t enable integration using the tools provided by EC2 Capacity Manager. For more information, see [this note](orgs_integrate_services.md#important-note-about-integration).   
If you enable trusted access by using the EC2 Capacity Manager console or tools then you don’t need to complete these steps.

To enable trusted access from the EC2 Capacity Manager console, sign in as an administrator in the management account and open the Amazon EC2 console. Navigate to Capacity Manager and go to the Settings tab. In the Trusted access section, choose **Manage trusted access** to enable it.

You can enable trusted access by using either the Amazon Organizations console, by running a Amazon CLI command, or by calling an API operation in one of the Amazon SDKs.

------
#### [ Amazon Web Services Management Console ]

**To enable trusted service access using the Organizations console**

1. Sign in to the [Amazon Organizations console](https://console.amazonaws.cn/organizations/v2). You must sign in as an IAM user, assume an IAM role, or sign in as the root user ([not recommended](https://docs.amazonaws.cn/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)) in the organization’s management account.

1. In the navigation pane, choose **Services**.

1. Choose **EC2 Capacity Manager** in the list of services.

1. Choose **Enable trusted access**.

1. In the **Enable trusted access for EC2 Capacity Manager** dialog box, type **enable** to confirm, and then choose **Enable trusted access**.

1. If you are the administrator of only Amazon Organizations, tell the administrator of EC2 Capacity Manager that they can now enable that service to work with Amazon Organizations from the service console.

------
#### [ Amazon CLI, Amazon API ]

**To enable trusted service access using the OrganizationsCLI/SDK**  
Use the following Amazon CLI commands or API operations to enable trusted service access:
+ Amazon CLI: [enable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/enable-aws-service-access.html)

  Run the following command to enable EC2 Capacity Manager as a trusted service with Organizations.

  ```
  $ aws organizations enable-aws-service-access \ 
      --service-principal ec2.capacitymanager.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [EnableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_EnableAWSServiceAccess.html)

------

## Disabling trusted access
<a name="integrate-disable-ta-ec2-capacity-manager"></a>

For information about the permissions needed to disable trusted access, see [Permissions required to disable trusted access](orgs_integrate_services.md#orgs_trusted_access_disable_perms).

To disable trusted access from the EC2 Capacity Manager console, navigate to Amazon EC2 Capacity Manager Settings tab. In the Trusted access section, choose **Manage trusted access** to disable it. Note: All delegated administrators must be removed prior to disabling trusted access.

You can disable trusted access using either the EC2 Capacity Manager or the Amazon Organizations tools.

**Important**  
We strongly recommend that whenever possible, you use the EC2 Capacity Manager console or tools to disable integration with Organizations. This lets EC2 Capacity Manager perform any clean up that it requires, such as deleting resources or access roles that are no longer needed by the service. Proceed with these steps only if you can’t disable integration using the tools provided by EC2 Capacity Manager.  
If you disable trusted access by using the EC2 Capacity Manager console or tools then you don’t need to complete these steps.

You can disable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.

------
#### [ Amazon CLI, Amazon API ]

**To disable trusted service access using the Organizations CLI/SDK**  
Use the following Amazon CLI commands or API operations to disable trusted service access:
+ Amazon CLI: [disable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/disable-aws-service-access.html)

  Run the following command to disable EC2 Capacity Manager as a trusted service with Organizations.

  ```
  $ aws organizations disable-aws-service-access \
      --service-principal ec2.capacitymanager.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [DisableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_DisableAWSServiceAccess.html)

------

## Enabling a delegated administrator account for EC2 Capacity Manager
<a name="integrate-enable-da-ec2-capacity-manager"></a>

A delegated administrator for EC2 Capacity Manager can manage Capacity Manager for your organization without using the management account. Delegated administrators have the ability to enable organization-level capacity management, view capacity data across all member accounts, modify settings between account-level and organization-level scope, and manage capacity forecasting for the entire organization. For more information, see [Delegated administrators for EC2 Capacity Manager](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/enable-capacity-manager-da.html) in the *Amazon EC2 User Guide*.

**Minimum permissions**  
Only an administrator in the Organizations management account can configure a delegated administrator for EC2 Capacity Manager.

You can specify a delegated administrator account using the EC2 Capacity Manager console by navigating to Settings and managing delegated administrators, or by using the Organizations `RegisterDelegatedAdministrator` CLI or SDK operation. To configure a delegated administrator using the EC2 Capacity Manager console, see [Add a delegated administrator](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/enable-capacity-manager-da.html#add-capacity-manager-da) in the *Amazon EC2 User Guide*.

------
#### [ Amazon CLI, Amazon API ]

You can register a delegated administrator account using the Amazon CLI or one of the Amazon SDKs:
+ Amazon CLI: [register-delegated-administrator](https://docs.amazonaws.cn/cli/latest/reference/organizations/register-delegated-administrator.html)

  ```
  $ aws organizations register-delegated-administrator \
      --account-id {{ACCOUNT_ID}} \
      --service-principal ec2.capacitymanager.amazonaws.com
  ```
+ Amazon API: [RegisterDelegatedAdministrator](https://docs.amazonaws.cn/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html)

------

## Disabling a delegated administrator account for EC2 Capacity Manager
<a name="integrate-disable-da-ec2-capacity-manager"></a>

Only an administrator in either the Organizations management account or the EC2 Capacity Manager delegated admin account can remove a delegated administrator account from the organization. You can remove a delegated administrator using the EC2 Capacity Manager console by choosing **Remove delegated administrator** in the Settings tab, or by using the Organizations `DeregisterDelegatedAdministrator` CLI or SDK operation. To remove a delegated administrator using the EC2 Capacity Manager console, see [Remove a delegated administrator](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/enable-capacity-manager-da.html#remove-capacity-manager-da) in the *Amazon EC2 User Guide*.

------
#### [ Amazon CLI, Amazon API ]

You can remove a delegated administrator account using the Amazon CLI or one of the Amazon SDKs:
+ Amazon CLI: [deregister-delegated-administrator](https://docs.amazonaws.cn/cli/latest/reference/organizations/deregister-delegated-administrator.html)

  ```
  $ aws organizations deregister-delegated-administrator \
      --account-id {{ACCOUNT_ID}} \
      --service-principal ec2.capacitymanager.amazonaws.com
  ```
+ Amazon API: [DeregisterDelegatedAdministrator](https://docs.amazonaws.cn/organizations/latest/APIReference/API_DeregisterDelegatedAdministrator.html)

------