I've been learning AWS for a few days now and the IAM policies are still confusing to me.
I need to allow a user the access to RunInstances and PassRole to that instance, but only specific roles. I followed the documentation here: http://docs.aws.amazon.com/IAM/latest/UserGuide/role-usecase-ec2app.html
I copy/pasted: * Example Policy that grants a user permission to launch an instance with a role by using the Amazon EC2 API * Then copy/pasted the ARN for the Role that I want to allow
The simulator doesn't like that so I replaced the Resource with a "*" and that works but is not at all what I'm trying to accomplish.
How do I allow a user to start an EC2 instance with only allowed roles?
Furthermore: I'm trying to actually use this policy by logging in the AWS console with the user in question and trying to start an instance an assign it a role. I can login, go to EC2, click on Launch Instance, pick an AMI, then I get this screen:
This was even done after I had edited the policy to have "*" as its Resource. So not even with the specific role ARN I want to restrict to. As you can see, there is a 500 error when calling getInstanceProfileList and the IAM role dropdown never "loads".