What are minimum permissions required for an IAM user to provision EC2 instances?

Question

I want to provision an EC2 instance with Ansible. So for that purpose I want to create a separate IAM user to keep things clear.

I can assign the full EC2 access to the user. But I don't want any other part of my account be affected if something bad happens.

What roles do I need to attach to the IAM user to be able to provision instances?

Answer 1

quick answer: - The user will need the permissions to execute the ec2 run-instances command.

Explanation on how to do this:

First create a policy (not Role) that authorizes the EC2 RunInstances action (find it in the table in the middle of the link). The EC2 RunInstances action requires access to many resources and you need to define which resources to maintain least privileges.

Review this AWS document explaining RunInstances and resource permissions needed. It also includes some example policies.

Note: AWS doesn't allow attaching roles directly to users. Instead, the user would to assume the role where you have added your new policy to that role, or the user would be added to an iam user group that had your new policy added to the permission policies.

======

To double check this works, I followed these steps:

1. Created a simple iam user with cli access: userX
2. Created a new iam policy using the visual editor that can access RunInstances action with any resource (not recommended for you in production, but ok for testing) : EC2RunInstancesAllResourcesPolicy
3. Created an iam user group: RunInstanceAdminGroup
4. Added EC2RunInstancesAllResourcesPolicy to the RunInstanceAdminGroup user group
5. Added userX to the RunInstanceAdminGroup
6. ran the ec2 run-instances command from the cli using userX credentials and it succeeded!