With this link, I can restrict user only to poweron/off a machine and terminate option is removed.

But, I want to restrict user to access only few machines assigned to the user and not show other machines.

With only the Owner or any custom tag we can filter.

How to do that?

1 Answer 1


Depends on how far you want to restrict that access and it will depend on how you define the IAM policy / role that you assign to the user.

For example, you can't prevent the user from seeing instances that don't match their custom tag filter because the DescribeInstances action doesn't accept Condition Keys. On the other hand, RunInstances does allow for aws:ResourceTag/${TagKey} condition keys to be applied, same for StartInstances and StopInstances.

You can have a look at https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html for the full list of actions and condition keys that apply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.