Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just had a look at the IAM user guide. Looks like the EC2 section is very short and not really detailed.

Are there any IAM Policy Actions for creating/deleting EC2 insance tags? Something like ec2:CreateTags or ec2:DeleteTags?


Ok, I made a test. It is the undocumented "ec2:CreateTags" and "ec2:DeleteTags" policy action.

share|improve this question

I'm also dealing with IAM this days (documentation is horrible). As far as I know IAM won't deal with tags, you need regular EC2 tools to do that, but it does create groups, maybe you can do something with that?

Good luck with IAM, so far it looks quite buggy and horribly documented to me.

share|improve this answer
Yeah, it is not detailed for every service. I made a test and "ec2:CreateTags" and "ec2:DeleteTags" works. – Jimbo Jan 21 '11 at 8:50
Oh good to hear it works :) – lynxman Jan 21 '11 at 8:53
But it is not officially. I will get in touch with the AWS. – Jimbo Jan 21 '11 at 9:21
see:… – Jimbo Jan 21 '11 at 9:31

Below is the snippet of IAM policy that is working for me for creating tags.

    "Effect": "Allow",
    "Action": [
    "Resource": [
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.