Regarding hiding all instances but one from the user
This cannot be done using IAM policies. The
ec2:Describe* commands (including
ec2:DescribeInstances) do not support resource-level permissions. So you can only allow or deny
ec2:Describe* for everything (
*). So your user can see all instances, or none.
Regarding trying to deny all, then override an allow
The order of the policy statements does not change the result of the policy. So don't try to write or interpret it "top down".
Policies work like this:
- The policy starts implicitly denying everything (this is implied deny)
- Any "Allow" statements override any implied denies (this is an explicit allow)
- Any "Deny" statements override all allows (this is an explicit deny)
So once you have a "Deny" statement, nothing can override that.
To be able to "pigeon hole" an allow, like you're trying to do, you must do one of these:
- Don't deny anything, allow only what you want to allow, or
- Deny everything except what you want to allow (in a single statement)
To accomplish what you want
The closest you'll get is to allow your user to "see" everything, but operate only on the one EC2 instance. You'll need 2 statements: