Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been learning AWS for a few days now and the IAM policies are still confusing to me.

I need to allow a user the access to RunInstances and PassRole to that instance, but only specific roles. I followed the documentation here: http://docs.aws.amazon.com/IAM/latest/UserGuide/role-usecase-ec2app.html

I copy/pasted: * Example Policy that grants a user permission to launch an instance with a role by using the Amazon EC2 API * Then copy/pasted the ARN for the Role that I want to allow

policy attempt 1

The simulator doesn't like that so I replaced the Resource with a "*" and that works but is not at all what I'm trying to accomplish.

How do I allow a user to start an EC2 instance with only allowed roles?

Furthermore: I'm trying to actually use this policy by logging in the AWS console with the user in question and trying to start an instance an assign it a role. I can login, go to EC2, click on Launch Instance, pick an AMI, then I get this screen:

trying to start an instance with a role

This was even done after I had edited the policy to have "*" as its Resource. So not even with the specific role ARN I want to restrict to. As you can see, there is a 500 error when calling getInstanceProfileList and the IAM role dropdown never "loads".

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.