we need to delegate management of several instances through AWS console to one of our clients. For this purpose we created a new IAM group.

We need this group to only list and modify specific EC2 instances, e.g. using a tag. We tried using the read-only ec2 template, and modifying it by adding:

  "Statement": [
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*",
      "Condition": {
         "StringEquals": {
            "ec2:ResourceTag/Tenant": "clientname"

This unfortunately results to "You are not authorized to describe Running Instances" for the aws console, and no instances are shown, although the correct tag exists. Please advise on how can we filter instance listing based on tags or other methods (e.g. VPC id).

  • It should work that way. Could you please post the whole statement. Possibly there is something later on which is wrong and denies the rights. – Osterjour May 27 '14 at 21:25

It can't be done. Amazon support answered this:

Unfortunately there isn't a way to only see certain instance(based on ec2-tag, vpc id etc). The "ec2:Describe*" API actions does not support any conditions or resource level ARNs.However you can have a policy wherein all the IAM Group will be able to see all the instances, but will only be able to perform actions like start, stop,reboot and terminate instances on instances with a specific tag

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.