what permision on lambda Role are needed for "compute optimizer" to work?

The following policy statement grants access to opt in to Compute Optimizer. It grants access to create a service-linked role for Compute Optimizer. This role is required to opt in. For more information, see Using Service-Linked Roles for AWS Compute Optimizer. It also grants access to update the enrollment status to the Compute Optimizer service.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam:::role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer", "Condition": {"StringLike": {"iam:AWSServiceName": "compute-optimizer.amazonaws.com"}} }, { "Effect": "Allow", "Action": "iam:PutRolePolicy", "Resource": "arn:aws:iam:::role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer" }, { "Effect": "Allow", "Action": "compute-optimizer:UpdateEnrollmentStatus", "Resource": "" } ] }

For other details & policies, refer to the link below: https://docs.aws.amazon.com/compute-optimizer/latest/ug/security-iam.html -- [1]