Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Q1: I am trying to create user in IAM AWS console that has restricted permissions only to start new instances using knife ec2 method. Currently only full access with policy "Amazon EC2 Full access" works. Creating user and granting start/stop instances and describe images does not work.

Q2: How i can debug this

ERROR: Fog::Compute::AWS::Error: UnauthorizedOperation => You are not authorized to perform this operation.

and trace down which exactly permission do i need. (-V -V -V didnt work)

share|improve this question
up vote 6 down vote accepted

Q1: I had to debug knife-ec2 gem in order to find out the minimal IAM permissions required to start an EC2 instance. Here is the minimal policy:

  "Statement": [
      "Sid": "Stmt123",
      "Action": [
      "Effect": "Allow",
      "Resource": [

Please note the Sid should be unique.

Q2: My knowledge of Ruby is quite limited so possibly there is not convenient way for debugging. Personally I used binding.pry as a debugger. Please refer to the following article for more info.

share|improve this answer

You will need to allow RunInstances.

share|improve this answer

I had to allow access in IAM to the user of which we are using "Access Key Id" and "Secret Access Key"

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.