what permision on lambda Role are needed for "compute optimizer" to work?

Question

basically as in the tilte.  What permissions are needed on a lambda Role for "Compute optimizer" to work with it?

Answer

The following policy statement grants access to opt in to Compute Optimizer. It grants access to create a service-linked role for Compute Optimizer. This role is required to opt in. For more information, see Using Service-Linked Roles for AWS Compute Optimizer. It also grants access to update the enrollment status to the Compute Optimizer service.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::*:role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer*",
            "Condition": {"StringLike": {"iam:AWSServiceName": "compute-optimizer.amazonaws.com"}}
        },
        {
            "Effect": "Allow",
            "Action": "iam:PutRolePolicy",
            "Resource": "arn:aws:iam::*:role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer"
        },
        {
            "Effect": "Allow",
            "Action": "compute-optimizer:UpdateEnrollmentStatus",
            "Resource": "*"
        }
    ]
}

For other details & policies, refer to the link below:
https://docs.aws.amazon.com/compute-optimizer/latest/ug/security-iam.html -- [1]

what permision on lambda Role are needed for "compute optimizer" to work?

相关内容