Actions, resources, and condition keys for Amazon EC2 - Service Authorization Reference

Actions, resources, and condition keys for Amazon EC2

Amazon EC2 (service prefix: ec2 ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by Amazon EC2

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table .

Actions Description Access level Resource types (*required) Condition keys Dependent actions
AcceptReservedInstancesExchangeQuote Grants permission to accept a Convertible Reserved Instance exchange quote Write
AcceptTransitGatewayMulticastDomainAssociations Grants permission to accept a request to associate subnets with a transit gateway multicast domain Write

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AcceptTransitGatewayPeeringAttachment Grants permission to accept a transit gateway peering attachment request Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AcceptTransitGatewayVpcAttachment Grants permission to accept a request to attach a VPC to a transit gateway Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AcceptVpcEndpointConnections Grants permission to accept one or more interface VPC endpoint connections to your VPC endpoint service Write

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AcceptVpcPeeringConnection Grants permission to accept a VPC peering connection request Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

vpc-peering-connection*

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

AdvertiseByoipCidr Grants permission to advertise an IP address range that is provisioned for use in AWS through bring your own IP addresses (BYOIP) Write
AllocateAddress Grants permission to allocate an Elastic IP address (EIP) to your account Write

elastic-ip*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

ipv4pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AllocateHosts Grants permission to allocate a Dedicated Host to your account Write

dedicated-host*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AutoPlacement

ec2:AvailabilityZone

ec2:HostRecovery

ec2:InstanceType

ec2:Quantity

ec2:Region

ec2:CreateTags

AllocateIpamPoolCidr Grants permission to allocate a CIDR from an Amazon VPC IP Address Manager (IPAM) pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

ApplySecurityGroupsToClientVpnTargetNetwork Grants permission to apply a security group to the association between a Client VPN endpoint and a target network Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AssignIpv6Addresses Grants permission to assign one or more IPv6 addresses to a network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

AssignPrivateIpAddresses Grants permission to assign one or more secondary private IP addresses to a network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

AssociateAddress Grants permission to associate an Elastic IP address (EIP) with an instance or a network interface Write

elastic-ip

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

network-interface

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

AssociateClientVpnTargetNetwork Grants permission to associate a target network with a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

subnet*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AssociateDhcpOptions Grants permission to associate or disassociate a set of DHCP options with a VPC Write

dhcp-options*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

AssociateEnclaveCertificateIamRole Grants permission to associate an ACM certificate with an IAM role to be used in an EC2 Enclave Write

certificate*

role*

AssociateIamInstanceProfile Grants permission to associate an IAM instance profile with a running or stopped instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:NewInstanceProfile

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

iam:PassRole

AssociateInstanceEventWindow Grants permission to associate one or more targets with an event window Write

instance-event-window*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AssociateRouteTable Grants permission to associate a subnet or gateway with a route table Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

vpn-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AssociateSubnetCidrBlock Grants permission to associate a CIDR block with a subnet Write

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

AssociateTransitGatewayMulticastDomain Grants permission to associate an attachment and list of subnets with a transit gateway multicast domain Write

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AssociateTransitGatewayRouteTable Grants permission to associate an attachment with a transit gateway route table Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AssociateTrunkInterface Grants permission to associate a branch network interface with a trunk network interface Write
AssociateVpcCidrBlock Grants permission to associate a CIDR block with a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Ipv4IpamPoolId

ec2:Ipv6IpamPoolId

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ipam-pool

ec2:Region

ec2:ResourceTag/${TagKey}

ipv6pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AttachClassicLinkVpc Grants permission to link an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC's security groups Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

AttachInternetGateway Grants permission to attach an internet gateway to a VPC Write

internet-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

AttachNetworkInterface Grants permission to attach a network interface to an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

AttachVolume Grants permission to attach an EBS volume to a running or stopped instance and expose it to the instance with the specified device name Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

volume*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

AttachVpnGateway Grants permission to attach a virtual private gateway to a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

vpn-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

AuthorizeClientVpnIngress Grants permission to add an inbound authorization rule to a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

AuthorizeSecurityGroupEgress Grants permission to add one or more outbound rules to a VPC security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ec2:CreateTags

AuthorizeSecurityGroupIngress Grants permission to add one or more inbound rules to a security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ec2:CreateTags

BundleInstance Grants permission to bundle an instance store-backed Windows instance Write
CancelBundleTask Grants permission to cancel a bundling operation Write
CancelCapacityReservation Grants permission to cancel a Capacity Reservation and release the reserved capacity Write

capacity-reservation*

aws:ResourceTag/${TagKey}

ec2:CapacityReservationFleet

ec2:Region

ec2:ResourceTag/${TagKey}

CancelCapacityReservationFleets Grants permission to cancel one or more Capacity Reservation Fleets Write

capacity-reservation-fleet*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CancelConversionTask Grants permission to cancel an active conversion task Write
CancelExportTask Grants permission to cancel an active export task Write

export-image-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

export-instance-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CancelImportTask Grants permission to cancel an in-process import virtual machine or import snapshot task Write

import-image-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

import-snapshot-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CancelReservedInstancesListing Grants permission to cancel a Reserved Instance listing on the Reserved Instance Marketplace Write
CancelSpotFleetRequests Grants permission to cancel one or more Spot Fleet requests Write

spot-fleet-request*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CancelSpotInstanceRequests Grants permission to cancel one or more Spot Instance requests Write

spot-instances-request*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ConfirmProductInstance Grants permission to determine whether an owned product code is associated with an instance Write
CopyFpgaImage Grants permission to copy a source Amazon FPGA image (AFI) to the current Region. Resource-level permissions specified for this action apply to the new AFI only. They do not apply to the source AFI Write

fpga-image*

ec2:Owner

ec2:Region

CopyImage Grants permission to copy an Amazon Machine Image (AMI) from a source Region to the current Region. Resource-level permissions specified for this action apply to the new AMI only. They do not apply to the source AMI Write

image*

ec2:Owner

ec2:Region

CopySnapshot Grants permission to copy a point-in-time snapshot of an EBS volume and store it in Amazon S3. Resource-level permissions specified for this action apply to the new snapshot only. They do not apply to the source snapshot Write

snapshot*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:OutpostArn

ec2:Region

ec2:SourceOutpostArn

ec2:CreateTags

CreateCapacityReservation Grants permission to create a Capacity Reservation Write

capacity-reservation*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:CapacityReservationFleet

ec2:Region

ec2:CreateTags

CreateCapacityReservationFleet Grants permission to create a Capacity Reservation Fleet Write

capacity-reservation-fleet*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateCarrierGateway Grants permission to create a carrier gateway and provides CSP connectivity to VPC customers Write

carrier-gateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateClientVpnEndpoint Grants permission to create a Client VPN endpoint Write

client-vpn-endpoint*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:SamlProviderArn

ec2:ServerCertificateArn

ec2:CreateTags

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateClientVpnRoute Grants permission to add a network route to a Client VPN endpoint's route table Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

subnet*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateCustomerGateway Grants permission to create a customer gateway, which provides information to AWS about your customer gateway device Write

customer-gateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateDefaultSubnet Grants permission to create a default subnet in a specified Availability Zone in a default VPC Write
CreateDefaultVpc Grants permission to create a default VPC with a default subnet in each Availability Zone Write
CreateDhcpOptions Grants permission to create a set of DHCP options for a VPC Write

dhcp-options*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateEgressOnlyInternetGateway Grants permission to create an egress-only internet gateway for a VPC Write

egress-only-internet-gateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateFleet Grants permission to launch an EC2 Fleet Write

fleet*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

instance*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceProfile

ec2:InstanceType

ec2:PlacementGroup

ec2:Region

ec2:RootDeviceType

ec2:Tenancy

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:KeyPairType

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

snapshot

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

CreateFlowLogs Grants permission to create one or more flow logs to capture IP traffic for a network interface Write

vpc-flow-log*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

iam:PassRole

network-interface

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateFpgaImage Grants permission to create an Amazon FPGA Image (AFI) from a design checkpoint (DCP) Write

fpga-image*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Owner

ec2:Public

ec2:Region

ec2:CreateTags

CreateImage Grants permission to create an Amazon EBS-backed AMI from a stopped or running Amazon EBS-backed instance Write

image*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Owner

ec2:Public

ec2:Region

ec2:CreateTags

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

snapshot

aws:ResourceTag/${TagKey}

ec2:OutpostArn

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:SourceOutpostArn

ec2:VolumeSize

CreateInstanceEventWindow Grants permission to create an event window in which scheduled events for the associated Amazon EC2 instances can run Write

instance-event-window*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateInstanceExportTask Grants permission to export a running or stopped instance to an Amazon S3 bucket Write

export-instance-task*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

CreateInternetGateway Grants permission to create an internet gateway for a VPC Write

internet-gateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateIpam Grants permission to create an Amazon VPC IP Address Manager (IPAM) Write

ipam*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateIpamPool Grants permission to create an IP address pool for Amazon VPC IP Address Manager (IPAM), which is a collection of contiguous IP address CIDRs Write

ipam-pool*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

ipam-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

CreateIpamScope Grants permission to create an Amazon VPC IP Address Manager (IPAM) scope, which is the highest-level container within IPAM Write

ipam*

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

ipam-scope*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

CreateKeyPair Grants permission to create a 2048-bit RSA key pair Write

key-pair*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:KeyPairType

ec2:Region

ec2:CreateTags

CreateLaunchTemplate Grants permission to create a launch template Write

launch-template*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateLaunchTemplateVersion Grants permission to create a new version of a launch template Write

launch-template*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateLocalGatewayRoute Grants permission to create a static route for a local gateway route table Write

local-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateLocalGatewayRouteTableVpcAssociation Grants permission to associate a VPC with a local gateway route table Write

local-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

local-gateway-route-table-vpc-association*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateManagedPrefixList Grants permission to create a managed prefix list Write

prefix-list*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateNatGateway Grants permission to create a NAT gateway in a subnet Write

natgateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

elastic-ip

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

CreateNetworkAcl Grants permission to create a network ACL in a VPC Write

network-acl*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateNetworkAclEntry Grants permission to create a numbered entry (a rule) in a network ACL Write

network-acl*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

CreateNetworkInsightsAccessScope Grants permission to create a Network Access Scope Write

network-insights-access-scope*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateNetworkInsightsPath Grants permission to create a path to analyze for reachability Write

network-insights-path*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceProfile

ec2:InstanceType

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

transit-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-peering-connection

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

vpn-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateNetworkInterface Grants permission to create a network interface in a subnet Write

network-interface*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

CreateNetworkInterfacePermission Grants permission to create a permission for an AWS-authorized user to perform certain operations on a network interface Permissions management

network-interface*

aws:ResourceTag/${TagKey}

ec2:AuthorizedService

ec2:AuthorizedUser

ec2:AvailabilityZone

ec2:Permission

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

CreatePlacementGroup Grants permission to create a placement group Write

placement-group*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:PlacementGroupStrategy

ec2:Region

ec2:CreateTags

CreatePublicIpv4Pool Grants permission to create a public IPv4 address pool for public IPv4 CIDRs that you own and bring to Amazon to manage with Amazon VPC IP Address Manager (IPAM) Write

network-insights-access-scope*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateReplaceRootVolumeTask Grants permission to create a root volume replacement task Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

ec2:CreateTags

replace-root-volume-task*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

volume*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

snapshot

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

CreateReservedInstancesListing Grants permission to create a listing for Standard Reserved Instances to be sold in the Reserved Instance Marketplace Write
CreateRestoreImageTask Grants permission to start a task that restores an AMI from an S3 object previously created by using CreateStoreImageTask Write

image*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Owner

ec2:Region

ec2:CreateTags

CreateRoute Grants permission to create a route in a VPC route table Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

CreateRouteTable Grants permission to create a route table for a VPC Write

route-table*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateSecurityGroup Grants permission to create a security group Write

security-group*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateSnapshot Grants permission to create a snapshot of an EBS volume and store it in Amazon S3 Write

snapshot*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:OutpostArn

ec2:ParentVolume

ec2:Region

ec2:SourceOutpostArn

ec2:VolumeSize

ec2:CreateTags

volume*

aws:ResourceTag/${TagKey}

ec2:Encrypted

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

CreateSnapshots Grants permission to create crash-consistent snapshots of multiple EBS volumes and store them in Amazon S3 Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceProfile

ec2:InstanceType

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

ec2:CreateTags

snapshot*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:OutpostArn

ec2:ParentVolume

ec2:Region

ec2:SourceOutpostArn

ec2:VolumeSize

volume*

aws:ResourceTag/${TagKey}

ec2:Encrypted

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

CreateSpotDatafeedSubscription Grants permission to create a data feed for Spot Instances to view Spot Instance usage logs Write
CreateStoreImageTask Grants permission to store an AMI as a single object in an S3 bucket Write

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

CreateSubnet Grants permission to create a subnet in a VPC Write

subnet*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

CreateSubnetCidrReservation Grants permission to create a subnet CIDR reservation Write
CreateTags Grants permission to add or overwrite one or more tags for Amazon EC2 resources Tagging

capacity-reservation

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

capacity-reservation-fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

customer-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

dedicated-host

aws:ResourceTag/${TagKey}

ec2:AutoPlacement

ec2:AvailabilityZone

ec2:HostRecovery

ec2:InstanceType

ec2:Quantity

ec2:Region

ec2:ResourceTag/${TagKey}

dhcp-options

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

egress-only-internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-gpu

aws:ResourceTag/${TagKey}

ec2:ElasticGpuType

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-ip

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

export-image-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

export-instance-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

fpga-image

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

host-reservation

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

import-image-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

import-snapshot-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

instance-event-window

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ipam

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-pool

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-scope

ec2:Region

ec2:ResourceTag/${TagKey}

ipv4pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ipv6pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:KeyPairType

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table-virtual-interface-group-association

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table-vpc-association

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

natgateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-acl

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

network-insights-access-scope

ec2:Region

ec2:ResourceTag/${TagKey}

network-insights-access-scope-analysis

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AuthorizedUser

ec2:AvailabilityZone

ec2:Permission

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

prefix-list

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

replace-root-volume-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

reserved-instances

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:InstanceType

ec2:Region

ec2:ReservedInstancesOfferingType

ec2:ResourceTag/${TagKey}

ec2:Tenancy

route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

security-group-rule

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

snapshot

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

spot-fleet-request

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

spot-instances-request

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

traffic-mirror-filter

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-session

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-target

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-connect-peer

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

volume

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

vpc-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint-service

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VpceServicePrivateDnsName

vpc-flow-log

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-peering-connection

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

vpn-connection

aws:ResourceTag/${TagKey}

ec2:AuthenticationType

ec2:DPDTimeoutSeconds

ec2:GatewayType

ec2:IKEVersions

ec2:InsideTunnelCidr

ec2:Phase1DHGroup

ec2:Phase1EncryptionAlgorithms

ec2:Phase1IntegrityAlgorithms

ec2:Phase1LifetimeSeconds

ec2:Phase2DHGroup

ec2:Phase2EncryptionAlgorithms

ec2:Phase2IntegrityAlgorithms

ec2:Phase2LifetimeSeconds

ec2:PreSharedKeys

ec2:Region

ec2:RekeyFuzzPercentage

ec2:RekeyMarginTimeSeconds

ec2:ResourceTag/${TagKey}

ec2:RoutingType

vpn-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateAction

CreateTrafficMirrorFilter Grants permission to create a traffic mirror filter Write

traffic-mirror-filter*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateTrafficMirrorFilterRule Grants permission to create a traffic mirror filter rule Write

traffic-mirror-filter*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateTrafficMirrorSession Grants permission to create a traffic mirror session Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

traffic-mirror-filter*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-session*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

traffic-mirror-target*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateTrafficMirrorTarget Grants permission to create a traffic mirror target Write

traffic-mirror-target*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

network-interface

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateTransitGateway Grants permission to create a transit gateway Write

transit-gateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateTransitGatewayConnect Grants permission to create a Connect attachment from a specified transit gateway attachment Write

transit-gateway-attachment*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

CreateTransitGatewayConnectPeer Grants permission to create a Connect peer between a transit gateway and an appliance Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

transit-gateway-connect-peer*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

CreateTransitGatewayMulticastDomain Grants permission to create a multicast domain for a transit gateway Write

transit-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

transit-gateway-multicast-domain*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

CreateTransitGatewayPeeringAttachment Grants permission to request a transit gateway peering attachment between a requester and accepter transit gateway Write

transit-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

transit-gateway-attachment*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

CreateTransitGatewayPrefixListReference Grants permission to create a transit gateway prefix list reference Write

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateTransitGatewayRoute Grants permission to create a static route for a transit gateway route table Write

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateTransitGatewayRouteTable Grants permission to create a route table for a transit gateway Write

transit-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

transit-gateway-route-table*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

CreateTransitGatewayVpcAttachment Grants permission to attach a VPC to a transit gateway Write

transit-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

transit-gateway-attachment*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

CreateVolume Grants permission to create an EBS volume Write

volume*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AvailabilityZone

ec2:Encrypted

ec2:KmsKeyId

ec2:ParentSnapshot

ec2:Region

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

ec2:CreateTags

CreateVpc Grants permission to create a VPC with a specified CIDR block Write

vpc*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Ipv4IpamPoolId

ec2:Ipv6IpamPoolId

ec2:Region

ec2:CreateTags

ipam-pool

ec2:Region

ec2:ResourceTag/${TagKey}

ipv6pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateVpcEndpoint Grants permission to create a VPC endpoint for an AWS service Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

route53:AssociateVPCWithHostedZone

vpc-endpoint*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:VpceServiceName

ec2:VpceServiceOwner

route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateVpcEndpointConnectionNotification Grants permission to create a connection notification for a VPC endpoint or VPC endpoint service Write

vpc-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateVpcEndpointServiceConfiguration Grants permission to create a VPC endpoint service configuration to which service consumers (AWS accounts, IAM users, and IAM roles) can connect Write

vpc-endpoint-service*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:VpceServicePrivateDnsName

ec2:CreateTags

CreateVpcPeeringConnection Grants permission to request a VPC peering connection between two VPCs Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ec2:CreateTags

vpc-peering-connection*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

CreateVpnConnection Grants permission to create a VPN connection between a virtual private gateway or transit gateway and a customer gateway Write

customer-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

vpn-connection*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AuthenticationType

ec2:DPDTimeoutSeconds

ec2:GatewayType

ec2:IKEVersions

ec2:InsideTunnelCidr

ec2:Phase1DHGroup

ec2:Phase1EncryptionAlgorithms

ec2:Phase1IntegrityAlgorithms

ec2:Phase1LifetimeSeconds

ec2:Phase2DHGroup

ec2:Phase2EncryptionAlgorithms

ec2:Phase2IntegrityAlgorithms

ec2:Phase2LifetimeSeconds

ec2:PreSharedKeys

ec2:Region

ec2:RekeyFuzzPercentage

ec2:RekeyMarginTimeSeconds

ec2:RoutingType

transit-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpn-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateVpnConnectionRoute Grants permission to create a static route for a VPN connection between a virtual private gateway and a customer gateway Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

CreateVpnGateway Grants permission to create a virtual private gateway Write

vpn-gateway*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

DeleteCarrierGateway Grants permission to delete a carrier gateway Write

carrier-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteClientVpnEndpoint Grants permission to delete a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DeleteClientVpnRoute Grants permission to delete a route from a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DeleteCustomerGateway Grants permission to delete a customer gateway Write

customer-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteDhcpOptions Grants permission to delete a set of DHCP options Write

dhcp-options*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteEgressOnlyInternetGateway Grants permission to delete an egress-only internet gateway Write

egress-only-internet-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteFleets Grants permission to delete one or more EC2 Fleets Write

fleet*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteFlowLogs Grants permission to delete one or more flow logs Write

vpc-flow-log*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteFpgaImage Grants permission to delete an Amazon FPGA Image (AFI) Write

fpga-image*

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteInstanceEventWindow Grants permission to delete the specified event window Write

instance-event-window*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteInternetGateway Grants permission to delete an internet gateway Write

internet-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteIpam Grants permission to delete an Amazon VPC IP Address Manager (IPAM) and remove all monitored data associated with the IPAM including the historical data for CIDRs Write

ipam*

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteIpamPool Grants permission to delete an Amazon VPC IP Address Manager (IPAM) pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteIpamScope Grants permission to delete the scope for an Amazon VPC IP Address Manager (IPAM) Write

ipam-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteKeyPair Grants permission to delete a key pair by removing the public key from Amazon EC2 Write

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:KeyPairType

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteLaunchTemplate Grants permission to delete a launch template and its associated versions Write

launch-template*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteLaunchTemplateVersions Grants permission to delete one or more versions of a launch template Write

launch-template*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteLocalGatewayRoute Grants permission to delete a route from a local gateway route table Write

local-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteLocalGatewayRouteTableVpcAssociation Grants permission to delete an association between a VPC and local gateway route table Write

local-gateway-route-table-vpc-association*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteManagedPrefixList Grants permission to delete a managed prefix list Write

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteNatGateway Grants permission to delete a NAT gateway Write

natgateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteNetworkAcl Grants permission to delete a network ACL Write

network-acl*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DeleteNetworkAclEntry Grants permission to delete an inbound or outbound entry (rule) from a network ACL Write

network-acl*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DeleteNetworkInsightsAccessScope Grants permission to delete a Network Access Scope Write

network-insights-access-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteNetworkInsightsAccessScopeAnalysis Grants permission to delete a Network Access Scope analysis Write

network-insights-access-scope-analysis*

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteNetworkInsightsAnalysis Grants permission to delete a network insights analysis Write

network-insights-analysis*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteNetworkInsightsPath Grants permission to delete a network insights path Write

network-insights-path*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteNetworkInterface Grants permission to delete a detached network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

DeleteNetworkInterfacePermission Grants permission to delete a permission that is associated with a network interface Permissions management

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

DeletePlacementGroup Grants permission to delete a placement group Write

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

DeletePublicIpv4Pool Grants permission to delete a public IPv4 address pool for public IPv4 CIDRs that you own and brought to Amazon to manage with Amazon VPC IP Address Manager (IPAM) Write

ipv4pool-ec2*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteQueuedReservedInstances Grants permission to delete the queued purchases for the specified Reserved Instances Write
DeleteRoute Grants permission to delete a route from a route table Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

prefix-list

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteRouteTable Grants permission to delete a route table Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DeleteSecurityGroup Grants permission to delete a security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DeleteSnapshot Grants permission to delete a snapshot of an EBS volume Write

snapshot*

aws:ResourceTag/${TagKey}

ec2:OutpostArn

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:SourceOutpostArn

ec2:VolumeSize

DeleteSpotDatafeedSubscription Grants permission to delete a data feed for Spot Instances Write
DeleteSubnet Grants permission to delete a subnet Write

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DeleteSubnetCidrReservation Grants permission to delete a subnet CIDR reservation Write
DeleteTags Grants permission to delete one or more tags from Amazon EC2 resources Tagging

capacity-reservation

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

capacity-reservation-fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

customer-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

dedicated-host

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

dhcp-options

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

egress-only-internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-gpu

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-ip

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

export-image-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

export-instance-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

fpga-image

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

host-reservation

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

image

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

import-image-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

import-snapshot-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

instance

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

instance-event-window

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ipam

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-pool

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-scope

ec2:Region

ec2:ResourceTag/${TagKey}

ipv4pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ipv6pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

key-pair

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table-virtual-interface-group-association

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table-vpc-association

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

natgateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-acl

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-insights-access-scope

ec2:Region

ec2:ResourceTag/${TagKey}

network-insights-access-scope-analysis

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

placement-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

prefix-list

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

replace-root-volume-task

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

reserved-instances

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

security-group-rule

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

snapshot

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

spot-fleet-request

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

spot-instances-request

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-filter

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-session

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-target

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-connect-peer

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

volume

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint-service

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-flow-log

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-peering-connection

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpn-connection

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpn-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTrafficMirrorFilter Grants permission to delete a traffic mirror filter Write

traffic-mirror-filter*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTrafficMirrorFilterRule Grants permission to delete a traffic mirror filter rule Write

traffic-mirror-filter*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-filter-rule*

ec2:Region

DeleteTrafficMirrorSession Grants permission to delete a traffic mirror session Write

traffic-mirror-session*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTrafficMirrorTarget Grants permission to delete a traffic mirror target Write

traffic-mirror-target*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGateway Grants permission to delete a transit gateway Write

transit-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayConnect Grants permission to delete a transit gateway connect attachment Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayConnectPeer Grants permission to delete a transit gateway connect peer Write

transit-gateway-connect-peer*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayMulticastDomain Grants permission to delete a transit gateway multicast domain Write

transit-gateway-multicast-domain*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayPeeringAttachment Grants permission to delete a peering attachment from a transit gateway Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayPrefixListReference Grants permission to delete a transit gateway prefix list reference Write

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayRoute Grants permission to delete a route from a transit gateway route table Write

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayRouteTable Grants permission to delete a transit gateway route table Write

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteTransitGatewayVpcAttachment Grants permission to delete a VPC attachment from a transit gateway Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteVolume Grants permission to delete an EBS volume Write

volume*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

DeleteVpc Grants permission to delete a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

DeleteVpcEndpointConnectionNotifications Grants permission to delete one or more VPC endpoint connection notifications Write

vpc-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint-service

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteVpcEndpointServiceConfigurations Grants permission to delete one or more VPC endpoint service configurations Write

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteVpcEndpoints Grants permission to delete one or more VPC endpoints Write

vpc-endpoint*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VpceServiceName

DeleteVpcPeeringConnection Grants permission to delete a VPC peering connection Write

vpc-peering-connection*

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

DeleteVpnConnection Grants permission to delete a VPN connection Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteVpnConnectionRoute Grants permission to delete a static route for a VPN connection between a virtual private gateway and a customer gateway Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeleteVpnGateway Grants permission to delete a virtual private gateway Write

vpn-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeprovisionByoipCidr Grants permission to release an IP address range that was provisioned through bring your own IP addresses (BYOIP), and to delete the corresponding address pool Write
DeprovisionIpamPoolCidr Grants permission to deprovision a CIDR provisioned from an Amazon VPC IP Address Manager (IPAM) pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

DeprovisionPublicIpv4PoolCidr Grants permission to deprovision a CIDR from a public IPv4 pool Write

ipv4pool-ec2*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeregisterImage Grants permission to deregister an Amazon Machine Image (AMI) Write

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

DeregisterInstanceEventNotificationAttributes Grants permission to remove tags from the set of tags to include in notifications about scheduled events for your instances Write
DeregisterTransitGatewayMulticastGroupMembers Grants permission to deregister one or more network interface members from a group IP address in a transit gateway multicast domain Write

network-interface

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

transit-gateway-multicast-domain

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DeregisterTransitGatewayMulticastGroupSources Grants permission to deregister one or more network interface sources from a group IP address in a transit gateway multicast domain Write

network-interface

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

transit-gateway-multicast-domain

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DescribeAccountAttributes Grants permission to describe the attributes of the AWS account List
DescribeAddresses Grants permission to describe one or more Elastic IP addresses List
DescribeAddressesAttribute Grants permission to describe the attributes of the specified Elastic IP addresses List

elastic-ip

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

DescribeAggregateIdFormat Grants permission to describe the longer ID format settings for all resource types List
DescribeAvailabilityZones Grants permission to describe one or more of the Availability Zones that are available to you List
DescribeBundleTasks Grants permission to describe one or more bundling tasks List
DescribeByoipCidrs Grants permission to describe the IP address ranges that were provisioned through bring your own IP addresses (BYOIP) List
DescribeCapacityReservationFleets Grants permission to describe one or more Capacity Reservation Fleets List
DescribeCapacityReservations Grants permission to describe one or more Capacity Reservations List
DescribeCarrierGateways Grants permission to describe one or more Carrier Gateways List
DescribeClassicLinkInstances Grants permission to describe one or more linked EC2-Classic instances List
DescribeClientVpnAuthorizationRules Grants permission to describe the authorization rules for a Client VPN endpoint List

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DescribeClientVpnConnections Grants permission to describe active client connections and connections that have been terminated within the last 60 minutes for a Client VPN endpoint List

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DescribeClientVpnEndpoints Grants permission to describe one or more Client VPN endpoints List

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DescribeClientVpnRoutes Grants permission to describe the routes for a Client VPN endpoint List

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DescribeClientVpnTargetNetworks Grants permission to describe the target networks that are associated with a Client VPN endpoint List

client-vpn-endpoint

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DescribeCoipPools Grants permission to describe the specified customer-owned address pools or all of your customer-owned address pools List
DescribeConversionTasks Grants permission to describe one or more conversion tasks List
DescribeCustomerGateways Grants permission to describe one or more customer gateways List
DescribeDhcpOptions Grants permission to describe one or more DHCP options sets List
DescribeEgressOnlyInternetGateways Grants permission to describe one or more egress-only internet gateways List
DescribeElasticGpus Grants permission to describe an Elastic Graphics accelerator that is associated with an instance Read
DescribeExportImageTasks Grants permission to describe one or more export image tasks List
DescribeExportTasks Grants permission to describe one or more export instance tasks List
DescribeFastSnapshotRestores Grants permission to describe the state of fast snapshot restores for snapshots Read
DescribeFleetHistory Grants permission to describe the events for an EC2 Fleet during a specified time List

fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DescribeFleetInstances Grants permission to describe the running instances for an EC2 Fleet List

fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DescribeFleets Grants permission to describe one or more EC2 Fleets List

fleet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DescribeFlowLogs Grants permission to describe one or more flow logs List
DescribeFpgaImageAttribute Grants permission to describe the attributes of an Amazon FPGA Image (AFI) List

fpga-image*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

DescribeFpgaImages Grants permission to describe one or more Amazon FPGA Images (AFIs) List
DescribeHostReservationOfferings Grants permission to describe the Dedicated Host Reservations that are available to purchase List
DescribeHostReservations Grants permission to describe the Dedicated Host Reservations that are associated with Dedicated Hosts in the AWS account List
DescribeHosts Grants permission to describe one or more Dedicated Hosts List
DescribeIamInstanceProfileAssociations Grants permission to describe the IAM instance profile associations List
DescribeIdFormat Grants permission to describe the ID format settings for resources List
DescribeIdentityIdFormat Grants permission to describe the ID format settings for resources for an IAM user, IAM role, or root user List
DescribeImageAttribute Grants permission to describe an attribute of an Amazon Machine Image (AMI) List

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

DescribeImages Grants permission to describe one or more images (AMIs, AKIs, and ARIs) List
DescribeImportImageTasks Grants permission to describe import virtual machine or import snapshot tasks List
DescribeImportSnapshotTasks Grants permission to describe import snapshot tasks List
DescribeInstanceAttribute Grants permission to describe the attributes of an instance List

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

DescribeInstanceCreditSpecifications Grants permission to describe the credit option for CPU usage of one or more burstable performance instances List
DescribeInstanceEventNotificationAttributes Grants permission to describe the set of tags to include in notifications about scheduled events for your instances List
DescribeInstanceEventWindows Grants permission to describe the specified event windows or all event windows List
DescribeInstanceStatus Grants permission to describe the status of one or more instances List
DescribeInstanceTypeOfferings Grants permission to describe the set of instance types that are offered in a location List
DescribeInstanceTypes Grants permission to describe the details of instance types that are offered in a location List
DescribeInstances Grants permission to describe one or more instances List
DescribeInternetGateways Grants permission to describe one or more internet gateways List
DescribeIpamPools Grants permission to describe Amazon VPC IP Address Manager (IPAM) pools List
DescribeIpamScopes Grants permission to describe Amazon VPC IP Address Manager (IPAM) scopes List
DescribeIpams Grants permission to describe an Amazon VPC IP Address Manager (IPAM) List
DescribeIpv6Pools Grants permission to describe one or more IPv6 address pools List
DescribeKeyPairs Grants permission to describe one or more key pairs List
DescribeLaunchTemplateVersions Grants permission to describe one or more launch template versions List
DescribeLaunchTemplates Grants permission to describe one or more launch templates List
DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations Grants permission to describe the associations between virtual interface groups and local gateway route tables List
DescribeLocalGatewayRouteTableVpcAssociations Grants permission to describe an association between VPCs and local gateway route tables List
DescribeLocalGatewayRouteTables Grants permission to describe one or more local gateway route tables List
DescribeLocalGatewayVirtualInterfaceGroups Grants permission to describe local gateway virtual interface groups List
DescribeLocalGatewayVirtualInterfaces Grants permission to describe local gateway virtual interfaces List
DescribeLocalGateways Grants permission to describe one or more local gateways List
DescribeManagedPrefixLists Grants permission to describe your managed prefix lists and any AWS-managed prefix lists List
DescribeMovingAddresses Grants permission to describe Elastic IP addresses that are being moved to the EC2-VPC platform List
DescribeNatGateways Grants permission to describe one or more NAT gateways List
DescribeNetworkAcls Grants permission to describe one or more network ACLs List
DescribeNetworkInsightsAccessScopeAnalyses Grants permission to describe one or more Network Access Scope analyses List
DescribeNetworkInsightsAccessScopes Grants permission to describe the Network Access Scopes List
DescribeNetworkInsightsAnalyses Grants permission to describe one or more network insights analyses List
DescribeNetworkInsightsPaths Grants permission to describe one or more network insights paths List
DescribeNetworkInterfaceAttribute Grants permission to describe a network interface attribute List
DescribeNetworkInterfacePermissions Grants permission to describe the permissions that are associated with a network interface List
DescribeNetworkInterfaces Grants permission to describe one or more network interfaces List
DescribePlacementGroups Grants permission to describe one or more placement groups List
DescribePrefixLists Grants permission to describe available AWS services in a prefix list format List
DescribePrincipalIdFormat Grants permission to describe the ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID (17-character ID) preference List
DescribePublicIpv4Pools Grants permission to describe one or more IPv4 address pools List
DescribeRegions Grants permission to describe one or more AWS Regions that are currently available in your account List
DescribeReplaceRootVolumeTasks Grants permission to describe a root volume replacement task List
DescribeReservedInstances Grants permission to describe one or more purchased Reserved Instances in your account List
DescribeReservedInstancesListings Grants permission to describe your account's Reserved Instance listings in the Reserved Instance Marketplace List
DescribeReservedInstancesModifications Grants permission to describe the modifications made to one or more Reserved Instances List
DescribeReservedInstancesOfferings Grants permission to describe the Reserved Instance offerings that are available for purchase List
DescribeRouteTables Grants permission to describe one or more route tables List
DescribeScheduledInstanceAvailability Grants permission to find available schedules for Scheduled Instances Read
DescribeScheduledInstances Grants permission to describe one or more Scheduled Instances in your account Read
DescribeSecurityGroupReferences Grants permission to describe the VPCs on the other side of a VPC peering connection that are referencing specified VPC security groups List
DescribeSecurityGroupRules Grants permission to describe one or more of your security group rules List
DescribeSecurityGroups Grants permission to describe one or more security groups List
DescribeSnapshotAttribute Grants permission to describe an attribute of a snapshot List
DescribeSnapshotTierStatus Grants permission to describe the storage tier status for Amazon EBS snapshots List
DescribeSnapshots Grants permission to describe one or more EBS snapshots List
DescribeSpotDatafeedSubscription Grants permission to describe the data feed for Spot Instances List
DescribeSpotFleetInstances Grants permission to describe the running instances for a Spot Fleet List
DescribeSpotFleetRequestHistory Grants permission to describe the events for a Spot Fleet request during a specified time List
DescribeSpotFleetRequests Grants permission to describe one or more Spot Fleet requests List
DescribeSpotInstanceRequests Grants permission to describe one or more Spot Instance requests List
DescribeSpotPriceHistory Grants permission to describe the Spot Instance price history List
DescribeStaleSecurityGroups Grants permission to describe the stale security group rules for security groups in a specified VPC List
DescribeStoreImageTasks Grants permission to describe the progress of the AMI store tasks List

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

DescribeSubnets Grants permission to describe one or more subnets List
DescribeTags Grants permission to describe one or more tags for an Amazon EC2 resource Read
DescribeTrafficMirrorFilters Grants permission to describe one or more traffic mirror filters List
DescribeTrafficMirrorSessions Grants permission to describe one or more traffic mirror sessions List
DescribeTrafficMirrorTargets Grants permission to describe one or more traffic mirror targets List
DescribeTransitGatewayAttachments Grants permission to describe one or more attachments between resources and transit gateways List
DescribeTransitGatewayConnectPeers Grants permission to describe one or more transit gateway connect peers List
DescribeTransitGatewayConnects Grants permission to describe one or more transit gateway connect attachments List
DescribeTransitGatewayMulticastDomains Grants permission to describe one or more transit gateway multicast domains List
DescribeTransitGatewayPeeringAttachments Grants permission to describe one or more transit gateway peering attachments List
DescribeTransitGatewayRouteTables Grants permission to describe one or more transit gateway route tables List
DescribeTransitGatewayVpcAttachments Grants permission to describe one or more VPC attachments on a transit gateway List
DescribeTransitGateways Grants permission to describe one or more transit gateways List
DescribeTrunkInterfaceAssociations Grants permission to describe one or more network interface trunk associations List
DescribeVolumeAttribute Grants permission to describe an attribute of an EBS volume List
DescribeVolumeStatus Grants permission to describe the status of one or more EBS volumes List
DescribeVolumes Grants permission to describe one or more EBS volumes List
DescribeVolumesModifications Grants permission to describe the current modification status of one or more EBS volumes Read
DescribeVpcAttribute Grants permission to describe an attribute of a VPC List
DescribeVpcClassicLink Grants permission to describe the ClassicLink status of one or more VPCs List
DescribeVpcClassicLinkDnsSupport Grants permission to describe the ClassicLink DNS support status of one or more VPCs List
DescribeVpcEndpointConnectionNotifications Grants permission to describe the connection notifications for VPC endpoints and VPC endpoint services List
DescribeVpcEndpointConnections Grants permission to describe the VPC endpoint connections to your VPC endpoint services List
DescribeVpcEndpointServiceConfigurations Grants permission to describe VPC endpoint service configurations (your services) List
DescribeVpcEndpointServicePermissions Grants permission to describe the principals (service consumers) that are permitted to discover your VPC endpoint service List
DescribeVpcEndpointServices Grants permission to describe all supported AWS services that can be specified when creating a VPC endpoint List
DescribeVpcEndpoints Grants permission to describe one or more VPC endpoints List
DescribeVpcPeeringConnections Grants permission to describe one or more VPC peering connections List
DescribeVpcs Grants permission to describe one or more VPCs List
DescribeVpnConnections Grants permission to describe one or more VPN connections Read
DescribeVpnGateways Grants permission to describe one or more virtual private gateways List
DetachClassicLinkVpc Grants permission to unlink (detach) a linked EC2-Classic instance from a VPC Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

DetachInternetGateway Grants permission to detach an internet gateway from a VPC Write

internet-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

DetachNetworkInterface Grants permission to detach a network interface from an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

DetachVolume Grants permission to detach an EBS volume from an instance Write

volume*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

DetachVpnGateway Grants permission to detach a virtual private gateway from a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

vpn-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DisableEbsEncryptionByDefault Grants permission to disable EBS encryption by default for your account Write
DisableFastSnapshotRestores Grants permission to disable fast snapshot restores for one or more snapshots in specified Availability Zones Write

snapshot*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

DisableImageDeprecation Grants permission to cancel the deprecation of the specified AMI Write

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

DisableIpamOrganizationAdminAccount Grants permission to disable an AWS Organizations member account as an Amazon VPC IP Address Manager (IPAM) admin account Write
DisableSerialConsoleAccess Grants permission to disable access to the EC2 serial console of all instances for your account Write
DisableTransitGatewayRouteTablePropagation Grants permission to disable a resource attachment from propagating routes to the specified propagation route table Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DisableVgwRoutePropagation Grants permission to disable a virtual private gateway from propagating routes to a specified route table of a VPC Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

vpn-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DisableVpcClassicLink Grants permission to disable ClassicLink for a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

DisableVpcClassicLinkDnsSupport Grants permission to disable ClassicLink DNS support for a VPC Write

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

DisassociateAddress Grants permission to disassociate an Elastic IP address from an instance or network interface Write

elastic-ip

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

DisassociateClientVpnTargetNetwork Grants permission to disassociate a target network from a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

DisassociateEnclaveCertificateIamRole Grants permission to disassociate an ACM certificate from a IAM role Write

certificate*

role*

DisassociateIamInstanceProfile Grants permission to disassociate an IAM instance profile from a running or stopped instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

DisassociateInstanceEventWindow Grants permission to disassociate one or more targets from an event window Write

instance-event-window*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DisassociateRouteTable Grants permission to disassociate a subnet from a route table Write

route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DisassociateSubnetCidrBlock Grants permission to disassociate a CIDR block from a subnet Write

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

DisassociateTransitGatewayMulticastDomain Grants permission to disassociate one or more subnets from a transit gateway multicast domain Write

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DisassociateTransitGatewayRouteTable Grants permission to disassociate a resource attachment from a transit gateway route table Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

DisassociateTrunkInterface Grants permission to disassociate a branch network interface to a trunk network interface Write
DisassociateVpcCidrBlock Grants permission to disassociate a CIDR block from a VPC Write

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

EnableEbsEncryptionByDefault Grants permission to enable EBS encryption by default for your account Write
EnableFastSnapshotRestores Grants permission to enable fast snapshot restores for one or more snapshots in specified Availability Zones Write

snapshot*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

EnableImageDeprecation Grants permission to enable deprecation of the specified AMI at the specified date and time Write

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

EnableIpamOrganizationAdminAccount Grants permission to enable an AWS Organizations member account as an Amazon VPC IP Address Manager (IPAM) admin account Write
EnableSerialConsoleAccess Grants permission to enable access to the EC2 serial console of all instances for your account Write
EnableTransitGatewayRouteTablePropagation Grants permission to enable an attachment to propagate routes to a propagation route table Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

EnableVgwRoutePropagation Grants permission to enable a virtual private gateway to propagate routes to a VPC route table Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

vpn-gateway*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

EnableVolumeIO Grants permission to enable I/O operations for a volume that had I/O operations disabled Write

volume*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

EnableVpcClassicLink Grants permission to enable a VPC for ClassicLink Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

EnableVpcClassicLinkDnsSupport Grants permission to enable a VPC to support DNS hostname resolution for ClassicLink Write

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ExportClientVpnClientCertificateRevocationList Grants permission to download the client certificate revocation list for a Client VPN endpoint Read

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

ExportClientVpnClientConfiguration Grants permission to download the contents of the Client VPN endpoint configuration file for a Client VPN endpoint Read

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

ExportImage Grants permission to export an Amazon Machine Image (AMI) to a VM file Write

export-image-task*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ExportTransitGatewayRoutes Grants permission to export routes from a transit gateway route table to an Amazon S3 bucket Write
GetAssociatedEnclaveCertificateIamRoles Grants permission to get the list of roles associated with an ACM certificate Read

certificate*

GetAssociatedIpv6PoolCidrs Grants permission to get information about the IPv6 CIDR block associations for a specified IPv6 address pool Read
GetCapacityReservationUsage Grants permission to get usage information about a Capacity Reservation Read

capacity-reservation*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

GetCoipPoolUsage Grants permission to describe the allocations from the specified customer-owned address pool Read
GetConsoleOutput Grants permission to get the console output for an instance Read

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

GetConsoleScreenshot Grants permission to retrieve a JPG-format screenshot of a running instance Read
GetDefaultCreditSpecification Grants permission to get the default credit option for CPU usage of a burstable performance instance family Read
GetEbsDefaultKmsKeyId Grants permission to get the ID of the default customer master key (CMK) for EBS encryption by default Read
GetEbsEncryptionByDefault Grants permission to describe whether EBS encryption by default is enabled for your account Read
GetFlowLogsIntegrationTemplate Grants permission to generate a CloudFormation template to streamline the integration of VPC flow logs with Amazon Athena Read

vpc-flow-log*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

GetGroupsForCapacityReservation Grants permission to list the resource groups to which a Capacity Reservation has been added List

capacity-reservation*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

GetHostReservationPurchasePreview Grants permission to preview a reservation purchase with configurations that match those of a Dedicated Host Read
GetInstanceTypesFromInstanceRequirements Grants permission to view a list of instance types with specified instance attributes Read
GetIpamAddressHistory Grants permission to retrieve historical information about a CIDR within an Amazon VPC IP Address Manager (IPAM) scope Read

ipam-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

GetIpamPoolAllocations Grants permission to get a list of all the CIDR allocations in an Amazon VPC IP Address Manager (IPAM) pool Read

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

GetIpamPoolCidrs Grants permission to get the CIDRs provisioned to an Amazon VPC IP Address Manager (IPAM) pool Read

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

GetIpamResourceCidrs Grants permission to get information about the resources in an Amazon VPC IP Address Manager (IPAM) scope Read

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

GetLaunchTemplateData Grants permission to get the configuration data of the specified instance for use with a new launch template or launch template version Read

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

GetManagedPrefixListAssociations Grants permission to get information about the resources that are associated with the specified managed prefix list Read

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

GetManagedPrefixListEntries Grants permission to get information about the entries for a specified managed prefix list Read

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

GetNetworkInsightsAccessScopeAnalysisFindings Grants permission to get the findings for one or more Network Access Scope analyses Read
GetNetworkInsightsAccessScopeContent Grants permission to get the content for a specified Network Access Scope Read
GetPasswordData Grants permission to retrieve the encrypted administrator password for a running Windows instance Read

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

GetReservedInstancesExchangeQuote Grants permission to return a quote and exchange information for exchanging one or more Convertible Reserved Instances for a new Convertible Reserved Instance Read
GetSerialConsoleAccessStatus Grants permission to retrieve the access status of your account to the EC2 serial console of all instances Read
GetSpotPlacementScores Grants permission to calculate the Spot placement score for a Region or Availability Zone based on the specified target capacity and compute requirements Read
GetSubnetCidrReservations Grants permission to retrieve information about the subnet CIDR reservations Read
GetTransitGatewayAttachmentPropagations Grants permission to list the route tables to which a resource attachment propagates routes List
GetTransitGatewayMulticastDomainAssociations Grants permission to get information about the associations for a transit gateway multicast domain List
GetTransitGatewayPrefixListReferences Grants permission to get information about prefix list references for a transit gateway route table List
GetTransitGatewayRouteTableAssociations Grants permission to get information about associations for a transit gateway route table List
GetTransitGatewayRouteTablePropagations Grants permission to get information about the route table propagations for a transit gateway route table List
GetVpnConnectionDeviceSampleConfiguration Grants permission to download an AWS-provided sample configuration file to be used with the customer gateway device List

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:AuthenticationType

ec2:DPDTimeoutSeconds

ec2:GatewayType

ec2:IKEVersions

ec2:InsideTunnelCidr

ec2:Phase1DHGroup

ec2:Phase1EncryptionAlgorithms

ec2:Phase1IntegrityAlgorithms

ec2:Phase1LifetimeSeconds

ec2:Phase2DHGroup

ec2:Phase2EncryptionAlgorithms

ec2:Phase2IntegrityAlgorithms

ec2:Phase2LifetimeSeconds

ec2:PreSharedKeys

ec2:Region

ec2:RekeyFuzzPercentage

ec2:RekeyMarginTimeSeconds

ec2:ResourceTag/${TagKey}

ec2:RoutingType

vpn-connection-device-type

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

GetVpnConnectionDeviceTypes Grants permission to obtain a list of customer gateway devices for which sample configuration files can be provided List
ImportClientVpnClientCertificateRevocationList Grants permission to upload a client certificate revocation list to a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

ImportImage Grants permission to import single or multi-volume disk images or EBS snapshots into an Amazon Machine Image (AMI) Write

image*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:RootDeviceType

ec2:CreateTags

import-image-task*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

snapshot

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

ImportInstance Grants permission to create an import instance task using metadata from a disk image Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceProfile

ec2:InstanceType

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

volume*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ImportKeyPair Grants permission to import a public key from an RSA key pair that was created with a third-party tool Write

key-pair*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

ImportSnapshot Grants permission to import a disk into an EBS snapshot Write

import-snapshot-task*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

snapshot*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:SnapshotTime

ec2:VolumeSize

ImportVolume Grants permission to create an import volume task using metadata from a disk image Write

volume*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

ListSnapshotsInRecycleBin Grants permission to list the Amazon EBS snapshots that are currently in the Recycle Bin List

snapshot

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

ModifyAddressAttribute Grants permission to modify an attribute of the specified Elastic IP address Write

elastic-ip*

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Attribute/${AttributeName}

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyAvailabilityZoneGroup Grants permission to modify the opt-in status of the Local Zone and Wavelength Zone group for your account Write
ModifyCapacityReservation Grants permission to modify a Capacity Reservation's capacity and the conditions under which it is to be released Write

capacity-reservation*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:CapacityReservationFleet

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyCapacityReservationFleet Grants permission to modify a Capacity Reservation Fleet Write

capacity-reservation-fleet*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyClientVpnEndpoint Grants permission to modify a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyDefaultCreditSpecification Grants permission to change the account level default credit option for CPU usage of burstable performance instances Write
ModifyEbsDefaultKmsKeyId Grants permission to change the default customer master key (CMK) for EBS encryption by default for your account Write
ModifyFleet Grants permission to modify an EC2 Fleet Write

fleet*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

snapshot

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ModifyFpgaImageAttribute Grants permission to modify an attribute of an Amazon FPGA Image (AFI) Write

fpga-image*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyHosts Grants permission to modify a Dedicated Host Write

dedicated-host*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyIdFormat Grants permission to modify the ID format for a resource Write
ModifyIdentityIdFormat Grants permission to modify the ID format of a resource for a specific principal in your account Write
ModifyImageAttribute Grants permission to modify an attribute of an Amazon Machine Image (AMI) Write

image*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ModifyInstanceAttribute Grants permission to modify an attribute of an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

volume

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

ModifyInstanceCapacityReservationAttributes Grants permission to modify the Capacity Reservation settings for a stopped instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

capacity-reservation

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyInstanceCreditSpecification Grants permission to modify the credit option for CPU usage on an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

ModifyInstanceEventStartTime Grants permission to modify the start time for a scheduled EC2 instance event Write

instance*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyInstanceEventWindow Grants permission to modify the specified event window Write

instance-event-window*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyInstanceMetadataOptions Grants permission to modify the metadata options for an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

ModifyInstancePlacement Grants permission to modify the placement attributes for an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

dedicated-host

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyIpam Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) Write

ipam*

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyIpamPool Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyIpamResourceCidr Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) resource CIDR Write

ipam-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyIpamScope Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) scope Write

ipam-scope*

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyLaunchTemplate Grants permission to modify a launch template Write

launch-template*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyManagedPrefixList Grants permission to modify a managed prefix list Write

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyNetworkInterfaceAttribute Grants permission to modify an attribute of a network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ModifyReservedInstances Grants permission to modify attributes of one or more Reserved Instances Write

reserved-instances*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:InstanceType

ec2:Region

ec2:ReservedInstancesOfferingType

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ModifySecurityGroupRules Grants permission to modify the rules of a security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

prefix-list

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

security-group-rule

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifySnapshotAttribute Grants permission to add or remove permission settings for a snapshot Permissions management

snapshot*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

ModifySnapshotTier Grants permission to archive Amazon EBS snapshots Write

snapshot*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

ModifySpotFleetRequest Grants permission to modify a Spot Fleet request Write

spot-fleet-request*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ModifySubnetAttribute Grants permission to modify an attribute of a subnet Write

subnet*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ModifyTrafficMirrorFilterNetworkServices Grants permission to allow or restrict mirroring network services Write

traffic-mirror-filter*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyTrafficMirrorFilterRule Grants permission to modify a traffic mirror rule Write

traffic-mirror-filter*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-filter-rule*

ec2:Attribute/${AttributeName}

ec2:Region

ModifyTrafficMirrorSession Grants permission to modify a traffic mirror session Write

traffic-mirror-session*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-filter

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-target

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyTransitGateway Grants permission to modify a transit gateway Write

transit-gateway*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyTransitGatewayPrefixListReference Grants permission to modify a transit gateway prefix list reference Write

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyTransitGatewayVpcAttachment Grants permission to modify a VPC attachment on a transit gateway Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyVolume Grants permission to modify the parameters of an EBS volume Write

volume*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

ModifyVolumeAttribute Grants permission to modify an attribute of a volume Write

volume*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Encrypted

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

ModifyVpcAttribute Grants permission to modify an attribute of a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ModifyVpcEndpoint Grants permission to modify an attribute of a VPC endpoint Write

vpc-endpoint*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

route-table

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

subnet

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyVpcEndpointConnectionNotification Grants permission to modify a connection notification for a VPC endpoint or VPC endpoint service Write

vpc-endpoint*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyVpcEndpointServiceConfiguration Grants permission to modify the attributes of a VPC endpoint service configuration Write

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VpceServicePrivateDnsName

ModifyVpcEndpointServicePermissions Grants permission to modify the permissions for a VPC endpoint service Permissions management

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyVpcPeeringConnectionOptions Grants permission to modify the VPC peering connection options on one side of a VPC peering connection Write

vpc-peering-connection*

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Attribute/${AttributeName}

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

ModifyVpcTenancy Grants permission to modify the instance tenancy attribute of a VPC Write

vpc*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ModifyVpnConnection Grants permission to modify the target gateway of a Site-to-Site VPN connection Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AuthenticationType

ec2:DPDTimeoutSeconds

ec2:GatewayType

ec2:IKEVersions

ec2:InsideTunnelCidr

ec2:Phase1DHGroup

ec2:Phase1EncryptionAlgorithms

ec2:Phase1IntegrityAlgorithms

ec2:Phase1LifetimeSeconds

ec2:Phase2DHGroup

ec2:Phase2EncryptionAlgorithms

ec2:Phase2IntegrityAlgorithms

ec2:Phase2LifetimeSeconds

ec2:PreSharedKeys

ec2:Region

ec2:RekeyFuzzPercentage

ec2:RekeyMarginTimeSeconds

ec2:ResourceTag/${TagKey}

ec2:RoutingType

ModifyVpnConnectionOptions Grants permission to modify the connection options for your Site-to-Site VPN connection Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyVpnTunnelCertificate Grants permission to modify the certificate for a Site-to-Site VPN connection Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ModifyVpnTunnelOptions Grants permission to modify the options for a Site-to-Site VPN connection Write

vpn-connection*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:AuthenticationType

ec2:DPDTimeoutSeconds

ec2:GatewayType

ec2:IKEVersions

ec2:InsideTunnelCidr

ec2:Phase1DHGroup

ec2:Phase1EncryptionAlgorithms

ec2:Phase1IntegrityAlgorithms

ec2:Phase1LifetimeSeconds

ec2:Phase2DHGroup

ec2:Phase2EncryptionAlgorithms

ec2:Phase2IntegrityAlgorithms

ec2:Phase2LifetimeSeconds

ec2:PreSharedKeys

ec2:Region

ec2:RekeyFuzzPercentage

ec2:RekeyMarginTimeSeconds

ec2:ResourceTag/${TagKey}

ec2:RoutingType

MonitorInstances Grants permission to enable detailed monitoring for a running instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

MoveAddressToVpc Grants permission to move an Elastic IP address from the EC2-Classic platform to the EC2-VPC platform Write
MoveByoipCidrToIpam Grants permission to move a BYOIP IPv4 CIDR to Amazon VPC IP Address Manager (IPAM) from a public IPv4 pool Write

ipam-pool

ec2:Region

ec2:ResourceTag/${TagKey}

ProvisionByoipCidr Grants permission to provision an address range for use in AWS through bring your own IP addresses (BYOIP), and to create a corresponding address pool Write
ProvisionIpamPoolCidr Grants permission to provision a CIDR to an Amazon VPC IP Address Manager (IPAM) pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

ProvisionPublicIpv4PoolCidr Grants permission to provision a CIDR to a public IPv4 pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

ipv4pool-ec2

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

PurchaseHostReservation Grants permission to purchase a reservation with configurations that match those of a Dedicated Host Write

dedicated-host*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

PurchaseReservedInstancesOffering Grants permission to purchase a Reserved Instance offering Write
PurchaseScheduledInstances Grants permission to purchase one or more Scheduled Instances with a specified schedule Write
RebootInstances Grants permission to request a reboot of one or more instances Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

RegisterImage Grants permission to register an Amazon Machine Image (AMI) Write

image*

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

snapshot

aws:ResourceTag/${TagKey}

ec2:OutpostArn

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:SourceOutpostArn

ec2:VolumeSize

RegisterInstanceEventNotificationAttributes Grants permission to add tags to the set of tags to include in notifications about scheduled events for your instances Write
RegisterTransitGatewayMulticastGroupMembers Grants permission to register one or more network interfaces as a member of a group IP address in a transit gateway multicast domain Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

transit-gateway-multicast-domain*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RegisterTransitGatewayMulticastGroupSources Grants permission to register one or more network interfaces as a source of a group IP address in a transit gateway multicast domain Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

transit-gateway-multicast-domain*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RejectTransitGatewayMulticastDomainAssociations Grants permission to reject requests to associate cross-account subnets with a transit gateway multicast domain Write

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RejectTransitGatewayPeeringAttachment Grants permission to reject a transit gateway peering attachment request Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RejectTransitGatewayVpcAttachment Grants permission to reject a request to attach a VPC to a transit gateway Write

transit-gateway-attachment*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RejectVpcEndpointConnections Grants permission to reject one or more VPC endpoint connection requests to a VPC endpoint service Write

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RejectVpcPeeringConnection Grants permission to reject a VPC peering connection request Write

vpc-peering-connection*

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

ReleaseAddress Grants permission to release an Elastic IP address Write

elastic-ip

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

ReleaseHosts Grants permission to release one or more On-Demand Dedicated Hosts Write

dedicated-host*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ReleaseIpamPoolAllocation Grants permission to release an allocation within an Amazon VPC IP Address Manager (IPAM) pool Write

ipam-pool*

ec2:Region

ec2:ResourceTag/${TagKey}

ReplaceIamInstanceProfileAssociation Grants permission to replace an IAM instance profile for an instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:NewInstanceProfile

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

iam:PassRole

ReplaceNetworkAclAssociation Grants permission to change which network ACL a subnet is associated with Write

network-acl*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ReplaceNetworkAclEntry Grants permission to replace an entry (rule) in a network ACL Write

network-acl*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ReplaceRoute Grants permission to replace a route within a route table in a VPC Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

carrier-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ec2:Vpc

egress-only-internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

instance

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

internet-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

natgateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

prefix-list

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-endpoint

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

vpc-peering-connection

aws:ResourceTag/${TagKey}

ec2:AccepterVpc

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

vpn-gateway

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ReplaceRouteTableAssociation Grants permission to change the route table that is associated with a subnet Write

route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ReplaceTransitGatewayRoute Grants permission to replace a route in a transit gateway route table Write

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ReportInstanceStatus Grants permission to submit feedback about the status of an instance Write
RequestSpotFleet Grants permission to create a Spot Fleet request Write

spot-fleet-request*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:KeyPairType

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

snapshot

aws:ResourceTag/${TagKey}

ec2:OutpostArn

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:SourceOutpostArn

ec2:VolumeSize

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

RequestSpotInstances Grants permission to create a Spot Instance request Write

spot-instances-request*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:CreateTags

image

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:KeyPairType

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AuthorizedUser

ec2:AvailabilityZone

ec2:Permission

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

snapshot

aws:ResourceTag/${TagKey}

ec2:OutpostArn

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:SourceOutpostArn

ec2:VolumeSize

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

ResetAddressAttribute Grants permission to reset the attribute of the specified IP address Write

elastic-ip*

aws:ResourceTag/${TagKey}

ec2:AllocationId

ec2:Attribute/${AttributeName}

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

ResetEbsDefaultKmsKeyId Grants permission to reset the default customer master key (CMK) for EBS encryption for your account to use the AWS-managed CMK for EBS Write
ResetFpgaImageAttribute Grants permission to reset an attribute of an Amazon FPGA Image (AFI) to its default value Write

fpga-image*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ResetImageAttribute Grants permission to reset an attribute of an Amazon Machine Image (AMI) to its default value Write

image*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ResetInstanceAttribute Grants permission to reset an attribute of an instance to its default value Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

ResetNetworkInterfaceAttribute Grants permission to reset an attribute of a network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

ResetSnapshotAttribute Grants permission to reset permission settings for a snapshot Permissions management

snapshot*

aws:ResourceTag/${TagKey}

ec2:Attribute/${AttributeName}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

RestoreAddressToClassic Grants permission to restore an Elastic IP address that was previously moved to the EC2-VPC platform back to the EC2-Classic platform Write
RestoreManagedPrefixListVersion Grants permission to restore the entries from a previous version of a managed prefix list to a new version of the prefix list Write

prefix-list*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

RestoreSnapshotFromRecycleBin Grants permission to restore an Amazon EBS snapshot from the Recycle Bin Write

snapshot*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

RestoreSnapshotTier Grants permission to restore an archived Amazon EBS snapshot for use temporarily or permanently, or modify the restore period or restore type for a snapshot that was previously temporarily restored Write

snapshot*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Encrypted

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

RevokeClientVpnIngress Grants permission to remove an inbound authorization rule from a Client VPN endpoint Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

RevokeSecurityGroupEgress Grants permission to remove one or more outbound rules from a VPC security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

RevokeSecurityGroupIngress Grants permission to remove one or more inbound rules from a security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

RunInstances Grants permission to launch one or more instances Write

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:CreateTags

instance*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:RootDeviceType

ec2:Tenancy

network-interface*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:Subnet

ec2:Vpc

security-group*

aws:ResourceTag/${TagKey}

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

subnet*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

volume*

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:AvailabilityZone

ec2:Encrypted

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:ParentSnapshot

ec2:Region

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

capacity-reservation

aws:ResourceTag/${TagKey}

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-gpu

aws:ResourceTag/${TagKey}

ec2:ElasticGpuType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-inference

key-pair

aws:ResourceTag/${TagKey}

ec2:IsLaunchTemplateResource

ec2:KeyPairName

ec2:KeyPairType

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template

aws:ResourceTag/${TagKey}

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

placement-group

aws:ResourceTag/${TagKey}

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

snapshot

aws:ResourceTag/${TagKey}

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

SCENARIO: EC2-Classic-EBS

image*

instance*

security-group*

volume*

key-pair

placement-group

snapshot

SCENARIO: EC2-Classic-InstanceStore

image*

instance*

security-group*

key-pair

placement-group

snapshot

SCENARIO: EC2-VPC-EBS

image*

instance*

network-interface*

security-group*

volume*

key-pair

placement-group

snapshot

SCENARIO: EC2-VPC-EBS-Subnet

image*

instance*

network-interface*

security-group*

subnet*

volume*

key-pair

placement-group

snapshot

SCENARIO: EC2-VPC-InstanceStore

image*

instance*

network-interface*

security-group*

key-pair

placement-group

snapshot

SCENARIO: EC2-VPC-InstanceStore-Subnet

image*

instance*

network-interface*

security-group*

subnet*

key-pair

placement-group

snapshot

RunScheduledInstances Grants permission to launch one or more Scheduled Instances Write

image*

aws:ResourceTag/${TagKey}

ec2:ImageType

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

key-pair

aws:ResourceTag/${TagKey}

ec2:KeyPairName

ec2:KeyPairType

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface

aws:ResourceTag/${TagKey}

ec2:AssociatePublicIpAddress

ec2:AuthorizedService

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

placement-group

aws:ResourceTag/${TagKey}

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

security-group

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

snapshot

aws:ResourceTag/${TagKey}

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:VolumeSize

subnet

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

SearchLocalGatewayRoutes Grants permission to search for routes in a local gateway route table List
SearchTransitGatewayMulticastGroups Grants permission to search for groups, sources, and members in a transit gateway multicast domain List
SearchTransitGatewayRoutes Grants permission to search for routes in a transit gateway route table List

transit-gateway-route-table*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

SendDiagnosticInterrupt Grants permission to send a diagnostic interrupt to an Amazon EC2 instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

SendSpotInstanceInterruptions [permission only] Grants permission to interrupt a Spot Instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

StartInstances Grants permission to start a stopped instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

StartNetworkInsightsAccessScopeAnalysis Grants permission to start a Network Access Scope analysis Write

network-insights-access-scope

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

StartNetworkInsightsAnalysis Grants permission to start analyzing a specified path Write

network-insights-analysis*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:CreateTags

network-insights-path*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

StartVpcEndpointServicePrivateDnsVerification Grants permission to start the private DNS verification process for a VPC endpoint service Write

vpc-endpoint-service*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

StopInstances Grants permission to stop an Amazon EBS-backed instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

TerminateClientVpnConnections Grants permission to terminate active Client VPN endpoint connections Write

client-vpn-endpoint*

aws:ResourceTag/${TagKey}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

TerminateInstances Grants permission to shut down one or more instances Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

UnassignIpv6Addresses Grants permission to unassign one or more IPv6 addresses from a network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

UnassignPrivateIpAddresses Grants permission to unassign one or more secondary private IP addresses from a network interface Write

network-interface*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

UnmonitorInstances Grants permission to disable detailed monitoring for a running instance Write

instance*

aws:ResourceTag/${TagKey}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

UpdateSecurityGroupRuleDescriptionsEgress Grants permission to update descriptions for one or more outbound rules in a VPC security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

UpdateSecurityGroupRuleDescriptionsIngress Grants permission to update descriptions for one or more inbound rules in a security group Write

security-group*

aws:ResourceTag/${TagKey}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

WithdrawByoipCidr Grants permission to stop advertising an address range that was provisioned for use in AWS through bring your own IP addresses (BYOIP) Write

Resource types defined by Amazon EC2

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table .

Resource types ARN Condition keys
elastic-ip arn:$ { Partition}:ec2:$ { Region}:$ { Account}:elastic-ip/$ { AllocationId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:AllocationId

ec2:Attribute/${AttributeName}

ec2:Domain

ec2:PublicIpAddress

ec2:Region

ec2:ResourceTag/${TagKey}

capacity-reservation-fleet arn:$ { Partition}:ec2:$ { Region}:$ { Account}:capacity-reservation-fleet/$ { CapacityReservationFleetId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

capacity-reservation arn:$ { Partition}:ec2:$ { Region}:$ { Account}:capacity-reservation/$ { CapacityReservationId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:CapacityReservationFleet

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

carrier-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:carrier-gateway/$ { CarrierGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

ec2:Vpc

certificate arn:$ { Partition}:acm:$ { Region}:$ { Account}:certificate/$ { CertificateId}
client-vpn-endpoint arn:$ { Partition}:ec2:$ { Region}:$ { Account}:client-vpn-endpoint/$ { ClientVpnEndpointId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:ClientRootCertificateChainArn

ec2:CloudwatchLogGroupArn

ec2:CloudwatchLogStreamArn

ec2:DirectoryArn

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SamlProviderArn

ec2:ServerCertificateArn

customer-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:customer-gateway/$ { CustomerGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

dedicated-host arn:$ { Partition}:ec2:$ { Region}:$ { Account}:dedicated-host/$ { DedicatedHostId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AutoPlacement

ec2:AvailabilityZone

ec2:HostRecovery

ec2:InstanceType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Quantity

ec2:Region

ec2:ResourceTag/${TagKey}

dhcp-options arn:$ { Partition}:ec2:$ { Region}:$ { Account}:dhcp-options/$ { DhcpOptionsId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

egress-only-internet-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:egress-only-internet-gateway/$ { EgressOnlyInternetGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-gpu arn:$ { Partition}:ec2:$ { Region}:$ { Account}:elastic-gpu/$ { ElasticGpuId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:ElasticGpuType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

elastic-inference arn:$ { Partition}:elastic-inference:$ { Region}:$ { Account}:elastic-inference-accelerator/$ { ElasticInferenceAcceleratorId}
export-image-task arn:$ { Partition}:ec2:$ { Region}:$ { Account}:export-image-task/$ { ExportImageTaskId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

export-instance-task arn:$ { Partition}:ec2:$ { Region}:$ { Account}:export-instance-task/$ { ExportTaskId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

fleet arn:$ { Partition}:ec2:$ { Region}:$ { Account}:fleet/$ { FleetId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

fpga-image arn:$ { Partition}:ec2:$ { Region}::fpga-image/$ { FpgaImageId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

host-reservation arn:$ { Partition}:ec2:$ { Region}:$ { Account}:host-reservation/$ { HostReservationId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

image arn:$ { Partition}:ec2:$ { Region}::image/$ { ImageId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:ImageType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Owner

ec2:Public

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

import-image-task arn:$ { Partition}:ec2:$ { Region}:$ { Account}:import-image-task/$ { ImportImageTaskId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

import-snapshot-task arn:$ { Partition}:ec2:$ { Region}:$ { Account}:import-snapshot-task/$ { ImportSnapshotTaskId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

instance-event-window arn:$ { Partition}:ec2:$ { Region}:$ { Account}:instance-event-window/$ { InstanceEventWindowId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

instance arn:$ { Partition}:ec2:$ { Region}:$ { Account}:instance/$ { InstanceId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:EbsOptimized

ec2:InstanceMarketType

ec2:InstanceProfile

ec2:InstanceType

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:MetadataHttpEndpoint

ec2:MetadataHttpPutResponseHopLimit

ec2:MetadataHttpTokens

ec2:NewInstanceProfile

ec2:PlacementGroup

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:RootDeviceType

ec2:Tenancy

internet-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:internet-gateway/$ { InternetGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ipam arn:$ { Partition}:ec2::$ { Account}:ipam/$ { IpamId}

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-pool arn:$ { Partition}:ec2::$ { Account}:ipam-pool/$ { IpamPoolId}

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ipam-scope arn:$ { Partition}:ec2::$ { Account}:ipam-scope/$ { IpamScopeId}

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ipv4pool-ec2 arn:$ { Partition}:ec2:$ { Region}:$ { Account}:ipv4pool-ec2/$ { Ipv4PoolEc2Id}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ipv6pool-ec2 arn:$ { Partition}:ec2:$ { Region}:$ { Account}:ipv6pool-ec2/$ { Ipv6PoolEc2Id}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

key-pair arn:$ { Partition}:ec2:$ { Region}:$ { Account}:key-pair/$ { KeyPairName}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:IsLaunchTemplateResource

ec2:KeyPairName

ec2:KeyPairType

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

launch-template arn:$ { Partition}:ec2:$ { Region}:$ { Account}:launch-template/$ { LaunchTemplateId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:local-gateway/$ { LocalGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table-virtual-interface-group-association arn:$ { Partition}:ec2:$ { Region}:$ { Account}:local-gateway-route-table-virtual-interface-group-association/$ { LocalGatewayRouteTableVirtualInterfaceGroupAssociationId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table-vpc-association arn:$ { Partition}:ec2:$ { Region}:$ { Account}:local-gateway-route-table-vpc-association/$ { LocalGatewayRouteTableVpcAssociationId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-route-table arn:$ { Partition}:ec2:$ { Region}:$ { Account}:local-gateway-route-table/$ { LocalGatewayRoutetableId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface-group arn:$ { Partition}:ec2:$ { Region}:$ { Account}:local-gateway-virtual-interface-group/$ { LocalGatewayVirtualInterfaceGroupId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

local-gateway-virtual-interface arn:$ { Partition}:ec2:$ { Region}:$ { Account}:local-gateway-virtual-interface/$ { LocalGatewayVirtualInterfaceId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

natgateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:natgateway/$ { NatGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

network-acl arn:$ { Partition}:ec2:$ { Region}:$ { Account}:network-acl/$ { NaclId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

network-insights-access-scope-analysis arn:$ { Partition}:ec2:$ { Region}:$ { Account}:network-insights-access-scope-analysis/$ { NetworkInsightsAccessScopeAnalysisId}

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

network-insights-access-scope arn:$ { Partition}:ec2:$ { Region}:$ { Account}:network-insights-access-scope/$ { NetworkInsightsAccessScopeId}

aws:RequestTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

network-insights-analysis arn:$ { Partition}:ec2:$ { Region}:$ { Account}:network-insights-analysis/$ { NetworkInsightsAnalysisId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

network-insights-path arn:$ { Partition}:ec2:$ { Region}:$ { Account}:network-insights-path/$ { NetworkInsightsPathId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

network-interface arn:$ { Partition}:ec2:$ { Region}:$ { Account}:network-interface/$ { NetworkInterfaceId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:AssociatePublicIpAddress

ec2:Attribute/${AttributeName}

ec2:AuthorizedService

ec2:AuthorizedUser

ec2:AvailabilityZone

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Permission

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Subnet

ec2:Vpc

placement-group arn:$ { Partition}:ec2:$ { Region}:$ { Account}:placement-group/$ { PlacementGroupName}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:PlacementGroupStrategy

ec2:Region

ec2:ResourceTag/${TagKey}

prefix-list arn:$ { Partition}:ec2:$ { Region}:$ { Account}:prefix-list/$ { PrefixListId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

replace-root-volume-task arn:$ { Partition}:ec2:$ { Region}:$ { Account}:replace-root-volume-task/$ { ReplaceRootVolumeTaskId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

reserved-instances arn:$ { Partition}:ec2:$ { Region}:$ { Account}:reserved-instances/$ { ReservationId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:InstanceType

ec2:Region

ec2:ReservedInstancesOfferingType

ec2:ResourceTag/${TagKey}

ec2:Tenancy

role arn:$ { Partition}:iam::$ { Account}:role/$ { RoleNameWithPath}
route-table arn:$ { Partition}:ec2:$ { Region}:$ { Account}:route-table/$ { RouteTableId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

security-group arn:$ { Partition}:ec2:$ { Region}:$ { Account}:security-group/$ { SecurityGroupId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

security-group-rule arn:$ { Partition}:ec2:$ { Region}:$ { Account}:security-group-rule/$ { SecurityGroupRuleId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

snapshot arn:$ { Partition}:ec2:$ { Region}::snapshot/$ { SnapshotId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Encrypted

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:OutpostArn

ec2:Owner

ec2:ParentVolume

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:SnapshotTime

ec2:SourceOutpostArn

ec2:VolumeSize

spot-fleet-request arn:$ { Partition}:ec2:$ { Region}:$ { Account}:spot-fleet-request/$ { SpotFleetRequestId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

spot-instances-request arn:$ { Partition}:ec2:$ { Region}:$ { Account}:spot-instances-request/$ { SpotInstanceRequestId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

subnet arn:$ { Partition}:ec2:$ { Region}:$ { Account}:subnet/$ { SubnetId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:IsLaunchTemplateResource

ec2:LaunchTemplate

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Vpc

traffic-mirror-filter arn:$ { Partition}:ec2:$ { Region}:$ { Account}:traffic-mirror-filter/$ { TrafficMirrorFilterId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-filter-rule arn:$ { Partition}:ec2:$ { Region}:$ { Account}:traffic-mirror-filter-rule/$ { TrafficMirrorFilterRuleId}

ec2:Attribute/${AttributeName}

ec2:Region

traffic-mirror-session arn:$ { Partition}:ec2:$ { Region}:$ { Account}:traffic-mirror-session/$ { TrafficMirrorSessionId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

traffic-mirror-target arn:$ { Partition}:ec2:$ { Region}:$ { Account}:traffic-mirror-target/$ { TrafficMirrorTargetId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-attachment arn:$ { Partition}:ec2:$ { Region}:$ { Account}:transit-gateway-attachment/$ { TransitGatewayAttachmentId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-connect-peer arn:$ { Partition}:ec2:$ { Region}:$ { Account}:transit-gateway-connect-peer/$ { TransitGatewayConnectPeerId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:transit-gateway/$ { TransitGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-multicast-domain arn:$ { Partition}:ec2:$ { Region}:$ { Account}:transit-gateway-multicast-domain/$ { TransitGatewayMulticastDomainId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

transit-gateway-route-table arn:$ { Partition}:ec2:$ { Region}:$ { Account}:transit-gateway-route-table/$ { TransitGatewayRouteTableId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

volume arn:$ { Partition}:ec2:$ { Region}:$ { Account}:volume/$ { VolumeId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AvailabilityZone

ec2:Encrypted

ec2:IsLaunchTemplateResource

ec2:KmsKeyId

ec2:LaunchTemplate

ec2:ParentSnapshot

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VolumeIops

ec2:VolumeSize

ec2:VolumeThroughput

ec2:VolumeType

vpc-endpoint arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpc-endpoint/$ { VpcEndpointId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VpceServiceName

ec2:VpceServiceOwner

vpc-endpoint-service arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpc-endpoint-service/$ { VpcEndpointServiceId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:VpceServicePrivateDnsName

vpc-flow-log arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpc-flow-log/$ { VpcFlowLogId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

vpc arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpc/$ { VpcId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:Ipv4IpamPoolId

ec2:Ipv6IpamPoolId

ec2:Region

ec2:ResourceTag/${TagKey}

ec2:Tenancy

vpc-peering-connection arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpc-peering-connection/$ { VpcPeeringConnectionId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:AccepterVpc

ec2:Attribute/${AttributeName}

ec2:Region

ec2:RequesterVpc

ec2:ResourceTag/${TagKey}

vpn-connection-device-type arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpn-connection-device-type/$ { VpnConnectionDeviceTypeId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

vpn-connection arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpn-connection/$ { VpnConnectionId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Attribute/${AttributeName}

ec2:AuthenticationType

ec2:DPDTimeoutSeconds

ec2:GatewayType

ec2:IKEVersions

ec2:InsideTunnelCidr

ec2:Phase1DHGroup

ec2:Phase1EncryptionAlgorithms

ec2:Phase1IntegrityAlgorithms

ec2:Phase1LifetimeSeconds

ec2:Phase2DHGroup

ec2:Phase2EncryptionAlgorithms

ec2:Phase2IntegrityAlgorithms

ec2:Phase2LifetimeSeconds

ec2:PreSharedKeys

ec2:Region

ec2:RekeyFuzzPercentage

ec2:RekeyMarginTimeSeconds

ec2:ResourceTag/${TagKey}

ec2:RoutingType

vpn-gateway arn:$ { Partition}:ec2:$ { Region}:$ { Account}:vpn-gateway/$ { VpnGatewayId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

ec2:Region

ec2:ResourceTag/${TagKey}

Condition keys for Amazon EC2

Amazon EC2 defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table .

To view the global condition keys that are available to all services, see Available global condition keys .

Condition keys Description Type
aws:RequestTag/${TagKey} Filters access by a tag key and value pair that is allowed in the request String
aws:ResourceTag/${TagKey} Filters access by a tag key and value pair of a resource String
aws:TagKeys Filters access by a list of tag keys that are allowed in the request String
ec2:AccepterVpc Filters access by the ARN of an accepter VPC in a VPC peering connection ARN
ec2:AllocationId Filters access by the Allocation Id of the Elastic Ip String
ec2:AssociatePublicIpAddress Filters access by whether the user wants to associate a public IP address with the instance Bool
ec2:Attribute/${AttributeName} Filters access by an attribute being set on a resource String
ec2:AuthenticationType Filters access by the authentication type for the VPN tunnel endpoints String
ec2:AuthorizedService Filters access by the AWS service that has permission to use a resource String
ec2:AuthorizedUser Filters access by an IAM principal that has permission to use a resource String
ec2:AutoPlacement Filters access by the Auto Placement properties of a Dedicated Host String
ec2:AvailabilityZone Filters access by the name of an Availability Zone in an AWS Region String
ec2:CapacityReservationFleet Filters access by the ARN of the Capacity Reservation Fleet ARN
ec2:ClientRootCertificateChainArn Filters access by the ARN of the client root certificate chain ARN
ec2:CloudwatchLogGroupArn Filters access by the ARN of the CloudWatch Logs log group ARN
ec2:CloudwatchLogStreamArn Filters access by the ARN of the CloudWatch Logs log stream ARN
ec2:CreateAction Filters access by the name of a resource-creating API action String
ec2:DPDTimeoutSeconds Filters access by the duration after which DPD timeout occurs on a VPN tunnel Numeric
ec2:DirectoryArn Filters access by the ARN of the directory ARN
ec2:Domain Filters access by the domain of the Elastic Ip Address String
ec2:EbsOptimized Filters access by whether the instance is enabled for EBS optimization Bool
ec2:ElasticGpuType Filters access by the type of Elastic Graphics accelerator String
ec2:Encrypted Filters access by whether the EBS volume is encrypted Bool
ec2:GatewayType Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection String
ec2:HostRecovery Filters access by whether host recovery is enabled for a Dedicated Host String
ec2:IKEVersions Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel String
ec2:ImageType Filters access by the type of image (machine, aki, or ari) String
ec2:InsideTunnelCidr Filters access by the range of inside IP addresses for a VPN tunnel String
ec2:InstanceMarketType Filters access by the market or purchasing option of an instance (on-demand or spot) String
ec2:InstanceProfile Filters access by the ARN of an instance profile ARN
ec2:InstanceType Filters access by the type of instance String
ec2:Ipv4IpamPoolId Filters access by the ID of an IPAM pool provided for IPv4 CIDR block allocation String
ec2:Ipv6IpamPoolId Filters access by the ID of an IPAM pool provided for IPv6 CIDR block allocation String
ec2:IsLaunchTemplateResource Filters access by whether users are able to override resources that are specified in the launch template Bool
ec2:KeyPairName Filters access by a key pair name String
ec2:KeyPairType Filters access by a key pair type String
ec2:KmsKeyId Filters access by an Id of your AWS Key Management Service String
ec2:LaunchTemplate Filters access by the ARN of a launch template ARN
ec2:MetadataHttpEndpoint Filters access by whether the HTTP endpoint is enabled for the instance metadata service String
ec2:MetadataHttpPutResponseHopLimit Filters access by the allowed number of hops when calling the instance metadata service Numeric
ec2:MetadataHttpTokens Filters access by whether tokens are required when calling the instance metadata service (optional or required) String
ec2:NewInstanceProfile Filters access by the ARN of the instance profile being attached ARN
ec2:OutpostArn Filters access by the ARN of the Outpost ARN
ec2:Owner Filters access by the owner of the resource (amazon, aws-marketplace, or an AWS account ID) String
ec2:ParentSnapshot Filters access by the ARN of the parent snapshot ARN
ec2:ParentVolume Filters access by the ARN of the parent volume from which the snapshot was created ARN
ec2:Permission Filters access by the type of permission for a resource (INSTANCE-ATTACH or EIP-ASSOCIATE) String
ec2:Phase1DHGroup Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations Numeric
ec2:Phase1EncryptionAlgorithms Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations String
ec2:Phase1IntegrityAlgorithms Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations String
ec2:Phase1LifetimeSeconds Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel Numeric
ec2:Phase2DHGroup Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations Numeric
ec2:Phase2EncryptionAlgorithms Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations String
ec2:Phase2IntegrityAlgorithms Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations String
ec2:Phase2LifetimeSeconds Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel Numeric
ec2:PlacementGroup Filters access by the ARN of the placement group ARN
ec2:PlacementGroupStrategy Filters access by the instance placement strategy used by the placement group (cluster, spread, or partition) String
ec2:PreSharedKeys Filters access by the pre-shared key (PSK) used to establish the initial IKE security association between a virtual private gateway and a customer gateway String
ec2:ProductCode Filters access by the product code that is associated with the AMI String
ec2:Public Filters access by whether the image has public launch permissions Bool
ec2:PublicIpAddress Filters access by the Public Ip String
ec2:Quantity Filters access by the number of Dedicated Hosts in a request Numeric
ec2:Region Filters access by the name of the AWS Region String
ec2:RekeyFuzzPercentage Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel Numeric
ec2:RekeyMarginTimeSeconds Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel Numeric
ec2:RequesterVpc Filters access by the ARN of a requester VPC in a VPC peering connection ARN
ec2:ReservedInstancesOfferingType Filters access by the payment option of the Reserved Instance offering (No Upfront, Partial Upfront, or All Upfront) String
ec2:ResourceTag/ Filters access by the preface string for a tag key and value pair that are attached to a resource String
ec2:ResourceTag/${TagKey} Filters access by a tag key and value pair of a resource String
ec2:RoleDelivery Filters access by the version of the instance metadata service for retrieving IAM role credentials for EC2 Numeric
ec2:RootDeviceType Filters access by the root device type of the instance (ebs or instance-store) String
ec2:RoutingType Filters access by the routing type for the VPN connection String
ec2:SamlProviderArn Filters access by the ARN of the IAM SAML identity provider ARN
ec2:ServerCertificateArn Filters access by the ARN of the server certificate ARN
ec2:SnapshotTime Filters access by the initiation time of a snapshot String
ec2:SourceInstanceARN Filters access by the ARN of the instance from which the request originated ARN
ec2:SourceOutpostArn Filters access by the ARN of the Outpost from which the request originated ARN
ec2:Subnet Filters access by the ARN of the subnet ARN
ec2:Tenancy Filters access by the tenancy of the VPC or instance (default, dedicated, or host) String
ec2:VolumeIops Filters access by the the number of input/output operations per second (IOPS) provisioned for the volume Numeric
ec2:VolumeSize Filters access by the size of the volume, in GiB Numeric
ec2:VolumeThroughput Filters access by the throughput of the volume, in MiBps Numeric
ec2:VolumeType Filters access by the type of volume (gp2, gp3, io1, io2, st1, sc1, or standard) String
ec2:Vpc Filters access by the ARN of the VPC ARN
ec2:VpceServiceName Filters access by the name of the VPC endpoint service String
ec2:VpceServiceOwner Filters access by the service owner of the VPC endpoint service (amazon, aws-marketplace, or an AWS account ID) String
ec2:VpceServicePrivateDnsName Filters access by the private DNS name of the VPC endpoint service String