Supported Resource-Level Permissions for Amazon EC2 API Actions
Resource-level permissions refers to the ability to specify which resources users are allowed to perform actions on. Amazon EC2 has partial support for resource-level permissions. This means that for certain Amazon EC2 actions, you can control when users are allowed to use those actions based on conditions that have to be fulfilled, or specific resources that users are allowed to use. For example, you can grant users permission to launch instances, but only of a specific type, and only using a specific AMI.
The following table describes the Amazon EC2 API actions that currently support resource-level permissions, as well as the supported resources (and their ARNs) and condition keys for each action. When specifying an ARN, you can use the * wildcard in your paths; for example, when you cannot or do not want to specify exact resource IDs. For examples of using wildcards, see Example Policies for Working With the AWS CLI, the Amazon EC2 CLI, or an AWS SDK .
Important
If an Amazon EC2 API action is not listed in this table, then it does not support resource-level permissions. If an Amazon EC2 API action does not support resource-level permissions, you can grant users permission to use the action, but you have to specify a * for the resource element of your policy statement. For an example of how to do this, see 1: Read-only access. We'll add support for additional actions, ARNs, and condition keys later. For a list of Amazon EC2 API actions that currently do not support resource-level permissions, see Unsupported Resource-Level Permissions in the Amazon EC2 API Reference.
| API Action | Resources | Condition Keys |
|---|---|---|
| AcceptVpcPeeringConnection |
VPC peering connection arn:aws:ec2:region:account:vpc-peering-connection/* arn:aws:ec2:region:account:vpc-peering-connection/vpc-peering-connection-id |
ec2:AccepterVpc ec2:Region ec2:ResourceTag/tag-key ec2:RequesterVpc |
|
VPC arn:aws:ec2:region:account:vpc/* arn:aws:ec2:region:account:vpc/vpc-id Where vpc-id is a VPC owned by the accepter. |
ec2:ResourceTag/tag-key ec2:Region ec2:Tenancy | |
| AttachClassicLinkVpc |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
|
Security group arn:aws:ec2:region:account:security-group/* arn:aws:ec2:region:account:security-group/security-group-id Where the security group is the security group for the VPC. |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
|
VPC arn:aws:ec2:region:account:vpc/* arn:aws:ec2:region:account:vpc/vpc-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Tenancy | |
| AttachVolume |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
|
Volume arn:aws:ec2:region:account:volume/* arn:aws:ec2:region:account:volume/volume-id |
ec2:AvailabilityZone ec2:ParentSnapshot ec2:Region ec2:ResourceTag/tag-key ec2:VolumeIops ec2:VolumeSize ec2:VolumeType | |
| AuthorizeSecurityGroupEgress |
Security group arn:aws:ec2:region:account:security-group/* arn:aws:ec2:region:account:security-group/security-group-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| AuthorizeSecurityGroupIngress |
Security group arn:aws:ec2:region:account:security-group/* arn:aws:ec2:region:account:security-group/security-group-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| CreateVpcPeeringConnection |
VPC arn:aws:ec2:region:account:vpc/* arn:aws:ec2:region:account:vpc/vpc-id Where vpc-id is a requester VPC. |
ec2:ResourceTag/tag-key ec2:Region ec2:Tenancy |
|
VPC peering connection arn:aws:ec2:region:account:vpc-peering-connection/* |
ec2:AccepterVpc ec2:Region ec2:RequesterVpc | |
| DeleteCustomerGateway |
Customer gateway arn:aws:ec2:region:account:customer-gateway/* arn:aws:ec2:region:account:customer-gateway/cgw-id |
ec2:Region ec2:ResourceTag/tag-key |
| DeleteDhcpOptions |
DHCP options set arn:aws:ec2:region:account:dhcp-options/* arn:aws:ec2:region:account:dhcp-options/dhcp-options-id |
ec2:Region ec2:ResourceTag/tag-key |
| DeleteInternetGateway |
Internet gateway arn:aws:ec2:region:account:internet-gateway/* arn:aws:ec2:region:account:internet-gateway/igw-id |
ec2:Region ec2:ResourceTag/tag-key |
| DeleteNetworkAcl |
Network ACL arn:aws:ec2:region:account:network-acl/* arn:aws:ec2:region:account:network-acl/nacl-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| DeleteNetworkAclEntry |
Network ACL arn:aws:ec2:region:account:network-acl/* arn:aws:ec2:region:account:network-acl/nacl-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| DeleteRoute |
Route table arn:aws:ec2:region:account:route-table/* arn:aws:ec2:region:account:route-table/route-table-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| DeleteRouteTable |
Route table arn:aws:ec2:region:account:route-table/* arn:aws:ec2:region:account:route-table/route-table-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| DeleteSecurityGroup |
Security group arn:aws:ec2:region:account:security-group/security-group-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| DeleteVolume |
Volume arn:aws:ec2:region:account:volume/* arn:aws:ec2:region:account:volume/volume-id |
ec2:AvailabilityZone ec2:ParentSnapshot ec2:Region ec2:ResourceTag/tag-key ec2:VolumeIops ec2:VolumeSize ec2:VolumeType |
| DeleteVpcPeeringConnection |
VPC peering connection arn:aws:ec2:region:account:vpc-peering-connection/* arn:aws:ec2:region:account:vpc-peering-connection/vpc-peering-connection-id |
ec2:AccepterVpc ec2:Region ec2:ResourceTag/tag-key ec2:RequesterVpc |
| DetachClassicLinkVpc |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
|
VPC arn:aws:ec2:region:account:vpc/* arn:aws:ec2:region:account:vpc/vpc-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Tenancy | |
| DetachVolume |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
|
Volume arn:aws:ec2:region:account:volume/* arn:aws:ec2:region:account:volume/volume-id |
ec2:AvailabilityZone ec2:ParentSnapshot ec2:Region ec2:ResourceTag/tag-key ec2:VolumeIops ec2:VolumeSize ec2:VolumeType | |
| DisableVpcClassicLink |
VPC arn:aws:ec2:region:account:vpc/* arn:aws:ec2:region:account:vpc/vpc-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Tenancy |
| EnableVpcClassicLink |
VPC arn:aws:ec2:region:account:vpc/* arn:aws:ec2:region:account:vpc/vpc-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Tenancy |
| RebootInstances |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
| RejectVpcPeeringConnection |
VPC peering connection arn:aws:ec2:region:account:vpc-peering-connection/* arn:aws:ec2:region:account:vpc-peering-connection/vpc-peering-connection-id |
ec2:AccepterVpc ec2:Region ec2:ResourceTag/tag-key ec2:RequesterVpc |
| RevokeSecurityGroupEgress |
Security group arn:aws:ec2:region:account:security-group/* arn:aws:ec2:region:account:security-group/security-group-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| RevokeSecurityGroupIngress |
Security group arn:aws:ec2:region:account:security-group/* arn:aws:ec2:region:account:security-group/security-group-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
| RunInstances |
Image arn:aws:ec2:region::image/* arn:aws:ec2:region::image/image-id |
ec2:ImageType ec2:Owner ec2:Public ec2:Region ec2:RootDeviceType ec2:ResourceTag/tag-key |
|
Instance arn:aws:ec2:region:account:instance/* |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:RootDeviceType ec2:Tenancy | |
|
Key pair arn:aws:ec2:region:account:key-pair/* arn:aws:ec2:region:account:key-pair/key-pair-name |
ec2:Region | |
|
Network interface arn:aws:ec2:region:account:network-interface/* arn:aws:ec2:region:account:network-interface/eni-id |
ec2:AvailabilityZone ec2:Region ec2:Subnet ec2:ResourceTag/tag-key ec2:Vpc | |
|
Placement group arn:aws:ec2:region:account:placement-group/* arn:aws:ec2:region:account:placement-group/placement-group-name |
ec2:Region ec2:PlacementGroupStrategy | |
|
Security group arn:aws:ec2:region:account:security-group/* arn:aws:ec2:region:account:security-group/security-group-id |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
|
Snapshot arn:aws:ec2:region::snapshot/* arn:aws:ec2:region::snapshot/snapshot-id |
ec2:Owner ec2:ParentVolume ec2:Region ec2:SnapshotTime ec2:ResourceTag/tag-key ec2:VolumeSize | |
|
Subnet arn:aws:ec2:region:account:subnet/* arn:aws:ec2:region:account:subnet/subnet-id |
ec2:AvailabilityZone ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
|
Volume arn:aws:ec2:region:account:volume/* |
ec2:AvailabilityZone ec2:ParentSnapshot ec2:Region ec2:VolumeIops ec2:VolumeSize ec2:VolumeType | |
| StartInstances |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
| StopInstances |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
| TerminateInstances |
Instance arn:aws:ec2:region:account:instance/* arn:aws:ec2:region:account:instance/instance-id |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy |
Resource-Level Permissions for RunInstances
The RunInstances
API action launches one or more instances, and creates and uses a number of Amazon EC2
resources. The action requires an AMI and creates an instance; and the instance must be
associated with a security group. Launching into a VPC requires a subnet, and creates a
network interface. Launching from an Amazon EBS-backed AMI creates a volume. The user must have
permission to use these resources, so they must be specified in the Resource
element of any policy that uses resource-level permissions for the
ec2:RunInstances action. If you don't intend to use resource-level
permissions with the ec2:RunInstances action, you can specify the * wildcard
in the Resource element of your statement instead of individual ARNs.
If you are using resource-level permissions, the following table describes the minimum
resources required to use the ec2:RunInstances action.
| Type of launch | Resources required | Condition keys |
|---|---|---|
| Launching into EC2-Classic using an instance store-backed AMI |
arn:aws:ec2:region:account:instance/* |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:RootDeviceType ec2:Tenancy |
| arn:aws:ec2:region::image/* (or a specific AMI ID) |
ec2:ImageType ec2:Owner ec2:Public ec2:Region ec2:RootDeviceType ec2:ResourceTag/tag-key | |
| arn:aws:ec2:region:account:security-group/* (or a specific security group ID) |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
| Launching into EC2-Classic using an Amazon EBS-backed AMI |
arn:aws:ec2:region:account:instance/* |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:RootDeviceType ec2:Tenancy |
| arn:aws:ec2:region::image/* (or a specific AMI ID) |
ec2:ImageType ec2:Owner ec2:Public ec2:Region ec2:RootDeviceType ec2:ResourceTag/tag-key | |
| arn:aws:ec2:region:account:security-group/* (or a specific security group ID) |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
| arn:aws:ec2:region:account:volume/* |
ec2:AvailabilityZone ec2:ParentSnapshot ec2:Region ec2:VolumeIops ec2:VolumeSize ec2:VolumeType | |
| Launching into a VPC using an instance store-backed AMI |
arn:aws:ec2:region:account:instance/* |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:RootDeviceType ec2:Tenancy |
| arn:aws:ec2:region::image/* (or a specific AMI ID) |
ec2:ImageType ec2:Owner ec2:Public ec2:Region ec2:RootDeviceType ec2:ResourceTag/tag-key | |
| arn:aws:ec2:region:account:security-group/* (or a specific security group ID) |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
| arn:aws:ec2:region:account:network-interface/* (or a specific network interface ID) |
ec2:AvailabilityZone ec2:Region ec2:Subnet ec2:ResourceTag/tag-key ec2:Vpc | |
| arn:aws:ec2:region:account:subnet/* (or a specific subnet ID) |
ec2:AvailabilityZone ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
| Launching into a VPC using an Amazon EBS-backed AMI |
arn:aws:ec2:region:account:instance/* |
ec2:AvailabilityZone ec2:EbsOptimized ec2:InstanceProfile ec2:InstanceType ec2:PlacementGroup ec2:Region ec2:RootDeviceType ec2:Tenancy |
| arn:aws:ec2:region::image/* (or a specific AMI ID) |
ec2:ImageType ec2:Owner ec2:Public ec2:Region ec2:RootDeviceType ec2:ResourceTag/tag-key | |
| arn:aws:ec2:region:account:security-group/* (or a specific security group ID) |
ec2:Region ec2:ResourceTag/tag-key ec2:Vpc | |
| arn:aws:ec2:region:account:network-interface/* (or a specific network interface ID) |
ec2:AvailabilityZone ec2:Region ec2:Subnet ec2:ResourceTag/tag-key ec2:Vpc | |
| arn:aws:ec2:region:account:volume/* |
ec2:AvailabilityZone ec2:ParentSnapshot ec2:Region ec2:VolumeIops ec2:VolumeSize ec2:VolumeType | |
| arn:aws:ec2:region:account:subnet/* (or a specific subnet ID) |
ec2:AvailabilityZone ec2:Region ec2:ResourceTag/tag-key ec2:Vpc |
We recommend that you also specify the key pair resource in your policy — even
though it's not required to launch an instance, you cannot connect to your instance
without a key pair. For examples of using resource-level permissions with the
ec2:RunInstances action, see 4: Launching instances (RunInstances).
For additional information about resource-level permissions in Amazon EC2, see the following AWS Security Blog post: Demystifying EC2 Resource-Level Permissions.
