Actions, resources, and condition keys for Amazon Compute Optimizer
Amazon Compute Optimizer (service prefix: compute-optimizer) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
API operations defined by Amazon Compute Optimizer
The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.
| Operation | IAM action | Condition key | Possible value(s) | Access level |
|---|---|---|---|---|
|
DeleteRecommendationPreferences |
Write |
|||
|
DescribeRecommendationExportJobs |
List |
|||
|
ExportAutoScalingGroupRecommendations |
Write |
|||
List |
||||
List |
||||
|
ExportEBSVolumeRecommendations |
Write |
|||
List |
||||
List |
||||
|
ExportEC2InstanceRecommendations |
Write |
|||
List |
||||
List |
||||
|
ExportECSServiceRecommendations |
Write |
|||
List |
||||
List |
||||
List |
||||
|
ExportIdleRecommendations |
Write |
|||
List |
||||
|
ExportLambdaFunctionRecommendations |
Write |
|||
List |
||||
List |
||||
List |
||||
|
ExportLicenseRecommendations |
Write |
|||
List |
||||
List |
||||
|
ExportRDSDatabaseRecommendations |
Write |
|||
List |
||||
List |
||||
List |
||||
|
GetAutoScalingGroupRecommendations |
List |
|||
List |
||||
|
GetEBSVolumeRecommendations |
List |
|||
List |
||||
|
GetEC2InstanceRecommendations |
List |
|||
List |
||||
|
GetEC2RecommendationProjectedMetrics |
List |
|||
List |
||||
|
GetECSServiceRecommendationProjectedMetrics |
compute-optimizer:GetECSServiceRecommendationProjectedMetrics |
List |
||
|
GetECSServiceRecommendations |
List |
|||
List |
||||
List |
||||
|
GetEffectiveRecommendationPreferences |
Read |
|||
List |
||||
List |
||||
List |
||||
|
GetEnrollmentStatus |
List |
|||
|
GetEnrollmentStatusesForOrganization |
List |
|||
List |
||||
|
GetIdleRecommendations |
List |
|||
|
GetLambdaFunctionRecommendations |
List |
|||
List |
||||
List |
||||
|
GetLicenseRecommendations |
List |
|||
List |
||||
|
GetRDSDatabaseRecommendationProjectedMetrics |
compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics |
List |
||
List |
||||
|
GetRDSDatabaseRecommendations |
List |
|||
List |
||||
List |
||||
|
GetRecommendationPreferences |
Read |
|||
|
GetRecommendationSummaries |
List |
|||
|
PutRecommendationPreferences |
Write |
|||
|
UpdateEnrollmentStatus |
Write |
Actions defined by Amazon Compute Optimizer
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in Amazon. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to delete recommendation preferences |
Write |
|||
Grants permission to view the status of recommendation export jobs |
List |
|||
Grants permission to export AutoScaling group recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to export EBS volume recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to export EC2 instance recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to export ECS service recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to export idle recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to export Lambda function recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to export license recommendations to S3 for the provided account(s) |
Write |
|||
Grants permission to export rds recommendations to S3 for the provided accounts |
Write |
|||
Grants permission to get recommendations for the provided AutoScaling groups |
List |
|||
Grants permission to get recommendations for the provided EBS volumes |
List |
|||
Grants permission to get recommendations for the provided EC2 instances |
List |
|||
Grants permission to get the recommendation projected metrics of the specified instance |
List |
|||
Grants permission to get the recommendation projected metrics of the specified ECS service |
List |
|||
Grants permission to get recommendations for the provided ECS services |
List |
|||
Grants permission to get recommendation preferences that are in effect |
Read |
|||
Grants permission to get the enrollment status for the specified account |
List |
|||
Grants permission to get the enrollment statuses for member accounts of the organization |
List |
|||
Grants permission to get idle recommendations for the specified account(s) |
List |
|||
Grants permission to get recommendations for the provided Lambda functions |
List |
|||
Grants permission to get license recommendations for the specified account(s) |
List |
|||
Grants permission to get the recommendation projected metrics of the specified instance |
List |
|||
Grants permission to get rds recommendations for the specified account(s) |
List |
|||
Grants permission to get recommendation preferences |
Read |
|||
Grants permission to get the recommendation summaries for the specified account(s) |
List |
|||
Grants permission to put recommendation preferences |
Write |
|||
Grants permission to update the enrollment status |
Write |
Resource types defined by Amazon Compute Optimizer
Amazon Compute Optimizer does not support specifying a resource ARN in the
Resource element of an IAM policy statement.
Condition keys for Amazon Compute Optimizer
Amazon Compute Optimizer defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by the resource type |
String |