# What your AWS account allows

SuperCI works with what your AWS account allows, as it is. Nothing has to be changed in AWS to use it.

When you sign in, SuperCI looks at the account and shows what it found in the **AWS account** section of the Control plane, set-up and Add runners pages. In a terminal:

```sh
superci accounts retrieve aws
```

## What it looks at

- **Regions.** Which regions the account may work in. Where regions are chosen, one the account cannot use is shown and cannot be picked, with why.
- **Spot machines.** Whether the account may start them. Where it may not, jobs run on on-demand machines, at about twice the price, and each job says so.
- **CPUs at once.** How many jobs that is, with a link to ask AWS for more.
- **The runner image.** Whether the image jobs run on is in each region the account may use.
- **Organization.** Whether a rule comes from an AWS organization the account is in, and which policy it is.

It only reads and asks "could I": nothing is started or changed by looking.

## A project from AWS's new sign-up

An account made with AWS's new sign-up (the one that starts with a builder or Google sign-in) is a *project*. AWS keeps a project to one region, chosen by your address: Ohio, Stockholm or Sydney.

SuperCI sets up in that region and runs jobs there.

- **Spot machines** are not allowed in a project until you activate *advanced features* in AWS's Settings. Until then jobs run on on-demand machines. Activating cannot be undone and removes AWS's spend limit, so set [limits](/docs/order-and-limits) of your own first.
- **The runner image** is not published in every region. Where it is missing, the set-up page offers to copy it into your account first: about ten minutes, and about $1.50 a month for its storage. In a terminal: `superci images create REGION`.

A copied image starts slower at first (about 25 seconds from queued to running, against about 16 with the published one) and gets faster as it is used.

## Allowing more regions

You do not need to. It helps only if you want jobs in a region the account cannot use today, such as N. Virginia, where the published image starts fastest.

The rule that refuses a region belongs to the AWS organization the account is in. Only that organization's management account can change it. SuperCI never signs in to a management account and changes no rule: you change it yourself, in AWS's console.

1. Sign in to AWS's console with the organization's management account. For a project, you have one only after activating advanced features: AWS's Settings lists it under **Management accounts**.
2. Open **AWS Organizations**, then **Policies**, then **Service control policies**.
3. Open the region policy. The list shows names: for a project it is **AdvancedModeRegionRestrictionSecurityControlPolicy**. Its page shows its id, the one SuperCI names in the Regions row (it looks like `p-a1b2c3d4`).
4. Press **Edit policy** and change only what the region you want needs:

| To allow | Change |
|---|---|
| N. Virginia (`us-east-1`) | Delete the whole statement whose `Sid` is `UsEast1Partitional`. |
| Oregon (`us-west-2`) | Delete the whole statement whose `Sid` is `UsWest2Partitional`. |
| Any other region | In the statement `RegionFloor`, add the region to the list under `aws:RequestedRegion`, for example `"eu-west-1"`. |

Those two statements are why N. Virginia and Oregon look half open in a project: AWS allows its global services there and refuses the rest. The last statement refuses every region that is not on its list.

SuperCI shows the change within ten minutes; `superci accounts retrieve aws` shows it at once.

If your company runs the organization, ask whoever manages it.