IAM policy doesn't let me start instances

Question

I've attached the following policy to a user, so that they can start and stop one specific instance.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": "arn:aws:ec2:::instance/i-01234567890"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "ec2:DescribeInstanceStatus",
            "Resource": "*"
        }
    ]
}

Using the following code, I get a 403 trying to start that instance:

conn = boto.ec2.connect_to_region("eu-west-1",
  aws_access_key_id=AWS_ACCESS,
  aws_secret_access_key=AWS_SECRET)

instance = conn.start_instances(instance_ids=['i-01234567890'], dry_run=True)

What am I doing wrong?

I've simulated the policy in the console, and it seems fine, I can start that specific instance under simulation. I've tried adding DescribeInstances (*) to the permissions, but even taking that approach does not work:

>>> conn.get_only_instances()[0]
Instance:i-01234567890
>>> conn.get_only_instances()[0].start()
<Permission Denied>

Can you run the script with verbose and paste the output here. I think you may need to check "stringslike" option for your IAM policy. — Shailesh Sutar, Jan 23 '18 at 18:00
I think your instance ARN is incomplete. Try adding the region and account number. — Matt Houser, Jan 24 '18 at 02:39

score 0 · Accepted Answer · answered Jan 24 '18 at 03:35

"arn:aws:ec2:::instance/i-01234567890"

to

"arn:aws:ec2:region:account-id:instance/i-01234567890"

where you need to substitute in your region and account-id as they are required for this resource type as documented at https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-ec2

IAM policy doesn't let me start instances

1 Answers1