I looked through the official docs and couldn't seem to find any reference as to which permissions the IAM user needs in order to be able to use this command.
I want the IAM user to only be able to create images for this one particular instance, so I had my policy set up like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt999",
"Effect": "Allow",
"Action": [
"ec2:CreateImage"
],
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:us-east-1:<my account id>:instance/<my instance id>"
]
}
]
}
But I kept getting Access Denied errors when using the EC2 CLI. I changed the Resource
part to just "*"
and now it works, but now my IAM user can create AMI's (therefore cause reboots) to any EC2 instances in my account.
How can I lock this down?