Common permissions for EC2 usage and VPC Security Groups in enterprise use

Question

Context: Looking to create some software that acts as middleware to a user's AWS account, where the user will provide their cloud credentials, and have the software use their EC2 instances.

Question: Trying to figure out any permission concerns for my target users. In an enterprise environment if I'm a data scientist that uses EC2 instances regularly to run models etc. and I have permissions to create, and destroy EC2 instances within my VPC, would I typically also have permissions to create and modify security groups? Or is it common to have security set up where the data scientists can use compute, but not permissions to modify or change SG?

From using EC2 it looks like they go hand in hand, e.g., during the EC2 instance creation process one step is to configure security groups as needed, so I'm led to believe the above question is yes, but unsure.

Thanks

Answer 1

Not technically, I understand your need to create and destroy EC2 instances, whether it's done via automation or not. About having permissions at the security group level, this can often be limited to viewing only the resource, as it is a networking firewall resource, usually who manages these objects are SDN or NaaS