AWS compute-optimizer documentation change

Service: compute-optimizer · 2025-09-28 · Documentation low

File: compute-optimizer/latest/ug/security-iam.md

Summary

Added JSON policy examples for service-linked roles, enrollment status updates, and organizational access

Security assessment

The changes provide explicit IAM policy configurations for Compute Optimizer access control, enhancing security documentation without addressing a specific vulnerability.

Diff

diff --git a/compute-optimizer/latest/ug/security-iam.md b/compute-optimizer/latest/ug/security-iam.md
index 6286913d6..f2e9bb536 100644
--- a//compute-optimizer/latest/ug/security-iam.md
+++ b//compute-optimizer/latest/ug/security-iam.md
@@ -81,0 +82,6 @@ This IAM role is required to opt in to AWS Compute Optimizer.
+JSON
+    
+
+****
+    
+    
@@ -104,0 +111,36 @@ This IAM role is required to opt in to AWS Compute Optimizer.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": "iam:CreateServiceLinkedRole",
+                "Resource": "arn:aws-cn:iam::*:role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer*",
+                "Condition": {"StringLike": {"iam:AWSServiceName": "compute-optimizer.amazonaws.com"}}
+            },
+            {
+                "Effect": "Allow",
+                "Action": "iam:PutRolePolicy",
+                "Resource": "arn:aws-cn:iam::*:role/aws-service-role/compute-optimizer.amazonaws.com/AWSServiceRoleForComputeOptimizer"
+            },
+            {
+                "Effect": "Allow",
+                "Action": "compute-optimizer:UpdateEnrollmentStatus",
+                "Resource": "*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": "organizations:DescribeOrganization",
+                "Resource": "*"
+            }
+        ]
+    }
+    
+
@@ -108,0 +151,6 @@ The following policy statement grants full access to Compute Optimizer for stand
+JSON
+    
+
+****
+    
+    
@@ -133,0 +183,6 @@ The following policy statement grants read-only access to Compute Optimizer for
+JSON
+    
+
+****
+    
+    
@@ -178,0 +235,6 @@ The following policy statement grants full access to Compute Optimizer for a man
+JSON
+    
+
+****
+    
+    
@@ -210,0 +274,6 @@ The following policy statement grants read-only access to Compute Optimizer for
+JSON
+    
+
+****
+    
+    
@@ -259,0 +330,6 @@ The following policy statements grant access to view and edit recommendation pre
+JSON
+    
+
+****
+    
+    
@@ -283,0 +361,6 @@ The following policy statements grant access to view and edit recommendation pre
+JSON
+    
+
+****
+    
+    
@@ -307,0 +392,6 @@ The following policy statements grant access to view and edit recommendation pre
+JSON
+    
+
+****
+    
+    
@@ -342,0 +434,6 @@ For Compute Optimizer to generate license recommendations, attach the following
+JSON
+    
+
+****
+    
+    
@@ -358,0 +457,6 @@ Additionally, to enable and receive license recommendations, attach the followin
+JSON
+    
+
+****
+    
+    
@@ -379,0 +485,6 @@ The following policy statement denies access to Compute Optimizer.
+JSON
+    
+
+****
+    
+