I'm trying to setup an instance profile for an EC2 instance that limits its access to a particular path within an S3 bucket, based on the Name tag of that EC2 instance. I've gotten a policy that's close, but still doesn't work.

    "Version": "2012-10-17",
    "Statement": [
            "Effect": "Allow",
            "Action": [
            "Resource": "arn:aws:s3:::some-bucket",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [

Turns out that in the case of IAM roles for EC2, the principal is the role itself; not the EC2 instance. Is there any way to use the tags from the EC2 instance in the policy document?

  • Did you find the answer? I am in similar situation. I want to shape my instance profile to only access required resources based on tags
    – user2574
    Apr 30, 2021 at 16:51
  • @user2574 No answer.
    – leedm777
    May 1, 2021 at 23:59


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy