Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been learning AWS for a few days now and the IAM policies are still confusing to me.

I need to allow a user the access to RunInstances and PassRole to that instance, but only specific roles. I followed the documentation here: http://docs.aws.amazon.com/IAM/latest/UserGuide/role-usecase-ec2app.html

I copy/pasted: * Example Policy that grants a user permission to launch an instance with a role by using the Amazon EC2 API * Then copy/pasted the ARN for the Role that I want to allow

policy attempt 1

The simulator doesn't like that so I replaced the Resource with a "*" and that works but is not at all what I'm trying to accomplish.

How do I allow a user to start an EC2 instance with only allowed roles?

Furthermore: I'm trying to actually use this policy by logging in the AWS console with the user in question and trying to start an instance an assign it a role. I can login, go to EC2, click on Launch Instance, pick an AMI, then I get this screen:

trying to start an instance with a role

This was even done after I had edited the policy to have "*" as its Resource. So not even with the specific role ARN I want to restrict to. As you can see, there is a 500 error when calling getInstanceProfileList and the IAM role dropdown never "loads".

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.