Amazon Trusted Advisor and Amazon Organizations
Amazon Trusted Advisor inspects your Amazon environment and makes recommendations when opportunities exist to save money, to improve system availability and performance, or to help close security gaps. When integrated with Organizations, you can receive Trusted Advisor check results for all of the accounts in your organization and download reports to view the summaries of your checks and any affected resources.
For more information, see Organizational view for Amazon Trusted Advisor in the Amazon Web Services Support User Guide.
Use the following information to help you integrate Amazon Trusted Advisor with Amazon Organizations.
Service-linked roles created when you enable integration
The following service-linked role is automatically created in your organization's management account when you enable trusted access. This role allows Trusted Advisor to perform supported operations within your organization's accounts in your organization.
You can delete or modify this role only if you disable trusted access between Trusted Advisor and Organizations, or if you remove the member account from the organization.
-
AWSServiceRoleForTrustedAdvisorReporting
Service principals used by the service-linked roles
The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by Trusted Advisor grant access to the following service principals:
-
reporting.trustedadvisor.amazonaws.com
Enabling trusted access with Trusted Advisor
For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.
You can enable trusted access using only Amazon Trusted Advisor.
To enable trusted access using the Trusted Advisor console
See Enable organizational view in the Amazon Web Services Support User Guide.
Disabling trusted access with Trusted Advisor
For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.
After you disable this feature, Trusted Advisor stops recording check information for all other accounts in your organization. You can't view or download existing reports or create new reports.
You can disable trusted access using either the Amazon Trusted Advisor or Amazon Organizations tools.
Important
We strongly recommend that whenever possible, you use the Amazon Trusted Advisor console or tools to disable integration with Organizations. This lets Amazon Trusted Advisor perform any clean up that it requires, such as deleting resources or access roles that are no longer needed by the service. Proceed with these steps only if you can’t disable integration using the tools provided by Amazon Trusted Advisor.
If you disable trusted access by using the Amazon Trusted Advisor console or tools then you don’t need to complete these steps.
To disable trusted access using the Trusted Advisor console
See Disable organizational view in the Amazon Web Services Support User Guide.
You can disable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.
Enabling a delegated administrator account for Trusted Advisor
When you designate a member account to be a delegated administrator for the organization, users and roles from the designated account can manage the Amazon Web Services account metadata for other member accounts in the organization. If you don't enable a delegated admin account, then these tasks can be performed only by the organization's management account. This helps you to separate management of the organization from management of your account details.
Minimum permissions
Only a user or role in the Organizations management account can configure a member account as a delegated administrator for Trusted Advisor in the organization
For instruction about enabling a delegated administrator account for Trusted Advisor, see Register delegated administrators in the Amazon Web Services Support User Guide.
Disabling a delegated administrator for Trusted Advisor
You can remove the delegated administrator using either the Trusted Advisor console, or by using the the Organizations DeregisterDelegatedAdministrator CLI or SDK operation. For information on how to disable the delegated admin Trusted Advisor account using the Trusted Advisor console,
see Deregister delegated administrators in the Amazon Web Services Support user guide.