In my AWS account we have 3 different applications, A, B, C.

I want to create an IAM policy for the B team that allows them to create new EC2 instances, but limit it to be tagged within the B resource group, or some other constraint that can definitively associate that new instance with the B group. Is that possible?


Yes, this is absolutely possible with IAM, using the Condition element. The Condition element lets you build expressions in which you can use Boolean operators to match against a condition, which in your case will be a resource with a specific tag.

For example, if you tag all the application B resources with "GroupB", the below IAM policy will restrict a user to being able to Start, Stop, and Reboot only EC2 resources that have that tag:

  "Version": "2012-10-17",
  "Statement": [
      "Action": [
      "Condition": {
        "StringEquals": {
      "Resource": [
      "Effect": "Allow"

You can find more information on Resource Groups on the AWS "What Are Resource Groups" page.

  • will it allow them to CREATE new instances as long as they are tagged GroupB as well?
    – kenwarner
    Oct 1 '15 at 19:25
  • Tags are assigned (initially) when you create an instance so I don't think that's possible. You could try creating a custom AMI and then restrict particular groups to only be able to start AMIs with a particular AMI ID (ami-xxxxxxxx). Oct 2 '15 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.