Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have volumes mounted on EC2 instances of which I would like to make snapshots.

I created a new IAM user with the following policy:

  "Statement": [
      "Sid": "...",
      "Effect": "Allow",
      "Action": [
      "Resource": [

I have added the access key and secret to my ~/.bashrc and sourced it. When I run ec2-describe-snapshots I get this response: Client.UnauthorizedOperation: You are not authorized to perform this operation.

When my "Resource" was just "*" I was able to list all types of Amazon's snapshots. I am looking to create snapshots owned by/visible to just me in the eu-west-1 region.

share|improve this question
up vote 5 down vote accepted

As wisely posted at How can I limit EC2 describe images permissions, resource level permissions are not implemented at all on ec2:Describe* actions.

In Reality you need to limit access based on other things and not the resource ARN.

share|improve this answer
I see! Well I tried directly just creating a snapshot with the same policy but I still encountered an error. I changed my Resource to * again and I was able to create the snapshot. Can I assume that the snapshots will always be created as private to my account? – juuga Jun 10 '14 at 12:42
By default yes. The snapshots are private unless set to public – zeridon Jun 10 '14 at 12:57
Thanks, I will work with this. – juuga Jun 10 '14 at 13:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.