ComputeOptimizerReadOnlyAccess

ReaderAWS managedActivePermissions reviewedShow on map Compare

Summary

Provides read only access to ComputeOptimizer.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess
Default version: v9
Created: 2020-03-07
Last edited: 2024-11-20
Services: autoscaling, cloudwatch, compute-optimizer, ec2, ecs, lambda, organizations, rds

Control-plane actions (30)

By access level: 26 List, 4 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
EC2 Auto Scaling	2 of 68	2 List; 0 restricted, 0 conditional	autoscaling:DescribeAutoScalingGroups, autoscaling:DescribeAutoScalingInstances
Compute Optimizer	17 of 28	15 List, 2 Read; 0 restricted, 0 conditional	compute-optimizer:DescribeRecommendationExportJobs, compute-optimizer:GetAutoScalingGroupRecommendations, compute-optimizer:GetEBSVolumeRecommendations, compute-optimizer:GetEC2InstanceRecommendations, compute-optimizer:GetEC2RecommendationProjectedMetrics, compute-optimizer:GetECSServiceRecommendationProjectedMetrics, compute-optimizer:GetECSServiceRecommendations, compute-optimizer:GetEffectiveRecommendationPreferences, compute-optimizer:GetEnrollmentStatus, compute-optimizer:GetEnrollmentStatusesForOrganization, compute-optimizer:GetIdleRecommendations, compute-optimizer:GetLambdaFunctionRecommendations and 5 more
EC2	2 of 834	2 List; 0 restricted, 0 conditional	ec2:DescribeInstances, ec2:DescribeVolumes
Elastic Container Service	2 of 92	2 List; 0 restricted, 0 conditional	ecs:ListClusters, ecs:ListServices
Lambda	2 of 121	2 List; 0 restricted, 0 conditional	lambda:ListFunctions, lambda:ListProvisionedConcurrencyConfigs
Organizations	3 of 63	1 List, 2 Read; 0 restricted, 0 conditional	organizations:DescribeAccount, organizations:DescribeOrganization, organizations:ListAccounts
RDS	2 of 173	2 List; 0 restricted, 0 conditional	rds:DescribeDBClusters, rds:DescribeDBInstances

EC2 Auto Scaling: 2 actions

autoscaling:DescribeAutoScalingGroups (List)
autoscaling:DescribeAutoScalingInstances (List)

Compute Optimizer: 17 actions

compute-optimizer:DescribeRecommendationExportJobs (List)
compute-optimizer:GetAutoScalingGroupRecommendations (List)
compute-optimizer:GetEBSVolumeRecommendations (List)
compute-optimizer:GetEC2InstanceRecommendations (List)
compute-optimizer:GetEC2RecommendationProjectedMetrics (List)
compute-optimizer:GetECSServiceRecommendationProjectedMetrics (List)
compute-optimizer:GetECSServiceRecommendations (List)
compute-optimizer:GetEffectiveRecommendationPreferences (Read)
compute-optimizer:GetEnrollmentStatus (List)
compute-optimizer:GetEnrollmentStatusesForOrganization (List)
compute-optimizer:GetIdleRecommendations (List)
compute-optimizer:GetLambdaFunctionRecommendations (List)
compute-optimizer:GetLicenseRecommendations (List)
compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics (List)
compute-optimizer:GetRDSDatabaseRecommendations (List)
compute-optimizer:GetRecommendationPreferences (Read)
compute-optimizer:GetRecommendationSummaries (List)

EC2: 2 actions

ec2:DescribeInstances (List)
ec2:DescribeVolumes (List)

Elastic Container Service: 2 actions

ecs:ListClusters (List)
ecs:ListServices (List)

Lambda: 2 actions

lambda:ListFunctions (List)
lambda:ListProvisionedConcurrencyConfigs (List)

Organizations: 3 actions

organizations:DescribeAccount (Read)
organizations:DescribeOrganization (Read)
organizations:ListAccounts (List)

RDS: 2 actions

rds:DescribeDBClusters (List)
rds:DescribeDBInstances (List)

Data-plane actions (1)

By access level: 1 Read.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	1 of 5	1 Read; 0 restricted, 0 conditional	cloudwatch:GetMetricData

CloudWatch: 1 actions

cloudwatch:GetMetricData (Read)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants only List and Read actions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "computeOptimizerReadOnlyAccess",
      "Effect": "Allow",
      "Action": [
        "compute-optimizer:DescribeRecommendationExportJobs",
        "compute-optimizer:GetEnrollmentStatus",
        "compute-optimizer:GetEnrollmentStatusesForOrganization",
        "compute-optimizer:GetRecommendationSummaries",
        "compute-optimizer:GetEC2InstanceRecommendations",
        "compute-optimizer:GetEC2RecommendationProjectedMetrics",
        "compute-optimizer:GetAutoScalingGroupRecommendations",
        "compute-optimizer:GetEBSVolumeRecommendations",
        "compute-optimizer:GetLambdaFunctionRecommendations",
        "compute-optimizer:GetRecommendationPreferences",
        "compute-optimizer:GetEffectiveRecommendationPreferences",
        "compute-optimizer:GetECSServiceRecommendations",
        "compute-optimizer:GetECSServiceRecommendationProjectedMetrics",
        "compute-optimizer:GetRDSDatabaseRecommendations",
        "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics",
        "compute-optimizer:GetLicenseRecommendations",
        "compute-optimizer:GetIdleRecommendations",
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ecs:ListServices",
        "ecs:ListClusters",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribeAutoScalingInstances",
        "lambda:ListFunctions",
        "lambda:ListProvisionedConcurrencyConfigs",
        "cloudwatch:GetMetricData",
        "organizations:ListAccounts",
        "organizations:DescribeOrganization",
        "organizations:DescribeAccount",
        "rds:DescribeDBInstances",
        "rds:DescribeDBClusters"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v9, edited by AWS on 2024-11-20. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "computeoptimizerreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/ComputeOptimizerReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("ComputeOptimizerReadOnlyAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.