I have created development group on which I want to impose group inline policy that would allow each member to be able to describe EC2 instances that have a tag with a Key "Product" that has a value equal to "TestProduct". The below shown example doesn't grant the required access, where if I leave resosurce * it works, so it is something on the way I define it not the credentials or above level.

    "Version": "2012-10-17",
    "Statement": [
            "Sid": "XXXX",
            "Effect": "Allow",
            "Action": [
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/Product": "TestProduct"

The error I receive in aws cli is: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.


The ec2:DescribeInstances command does not support resource-level permissions. This means that you must specify * as the Resource in the IAM policy statement. If you specify anything other than * for Resource, then authorization will fail (as you've already seen).

This means that you cannot "hide" instances from certain IAM users. Either an IAM user will see all instances, or none.

Please see the following document for a list of commands that support resource-level permissions: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-supported-iam-actions-resources.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.