I want to provision an EC2 instance with Ansible. So for that purpose I want to create a separate IAM user to keep things clear.

I can assign the full EC2 access to the user. But I don't want any other part of my account be affected if something bad happens.

What roles do I need to attach to the IAM user to be able to provision instances?

1 Answer 1


quick answer: - The user will need the permissions to execute the ec2 run-instances command.

Explanation on how to do this:

First create a policy (not Role) that authorizes the EC2 RunInstances action (find it in the table in the middle of the link). The EC2 RunInstances action requires access to many resources and you need to define which resources to maintain least privileges.

Review this AWS document explaining RunInstances and resource permissions needed. It also includes some example policies.

Note: AWS doesn't allow attaching roles directly to users. Instead, the user would to assume the role where you have added your new policy to that role, or the user would be added to an iam user group that had your new policy added to the permission policies.


To double check this works, I followed these steps:

  1. Created a simple iam user with cli access: userX
  2. Created a new iam policy using the visual editor that can access RunInstances action with any resource (not recommended for you in production, but ok for testing) : EC2RunInstancesAllResourcesPolicy enter image description here
  3. Created an iam user group: RunInstanceAdminGroup
  4. Added EC2RunInstancesAllResourcesPolicy to the RunInstanceAdminGroup user group
  5. Added userX to the RunInstanceAdminGroup
  6. ran the ec2 run-instances command from the cli using userX credentials and it succeeded!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.