CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
Rick Venuto
Rick Venuto

Reputation: 39

Enforce tag creation for EC2

I have been trying to create a policy that will not allow an ec2 instance to be created unless it has a Project tag. Here is what I have now and all I get is ec2:RunInstances You are not authorized to perform this operation even with I have the tag Project.

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "RunCloudFormation",
          "Effect": "Allow",
          "Action": [
              "cloudformation:*"
          ],
          "Resource": [
              "*"
          ]
      },
      {
          "Sid": "CreateEC2Instances",
          "Effect": "Allow",
          "Action": [
              "ec2:Describe*",
              "ec2:CreateSecurityGroup",
              "ec2:AuthorizeSecurityGroupIngress",
              "ec2:CreateTags",
              "ec2:RunInstances"
          ],
          "Resource": "*"
      },
      {
          "Sid": "LaunchingEC2withAMIsAndTags",
          "Effect": "Allow",
          "Action": "ec2:RunInstances",
          "Resource": "arn:aws:ec2:*:*:instance/*",
          "Condition": {
              "StringLike": {
                  "aws:RequestTag/Project": "?*"
              }
          }
      }
  ]
}

Here is a snippet of my CloudFormation template:

  "KeyName": {
          "Ref": "KeyName"
        },
        "Tags": [
          {
            "Key": "Project",
            "Value": "test"
          },
          {
            "Key": "OwnerAdmin",
            "Value": "myname"
          },
          {
            "Key": "Name",
            "Value": "TESTTags"
          }
        ],

Upvotes: 1

Views: 379

Answers (1)

Castrohenge
Castrohenge

Reputation: 8993

I managed to get the policy simulator to allow the RunInstances action by changing

"Resource": "arn:aws:ec2:*:*:instance/*"

to 

"Resource": "*",

You only need to use the resource level permissions if you want to constrain resources used by the instance, such as AMI, subnet, security group, etc.

Upvotes: 1

Related Questions