title: Minimal IAM policy for ec2:RunInstances
body: <p>I'm trying to narrow down the minimal policy to run a predefined machine image. The image is based on two snapshots and I only want "m1.medium" instance types to be launched.</p>
  
  <p>Based on that and with the help of <a href="http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html" rel="noreferrer">this page</a> and <a href="http://aws.typepad.com/aws/2013/11/amazon-ec2-resource-level-permissions-for-runinstances.html" rel="noreferrer">this article</a>, I worked out the following policy:</p>
  
  <pre class="lang-json prettyprint-override"><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1385026304010",
              "Effect": "Allow",
              "Action": [
                  "ec2:RunInstances"
              ],
              "Condition": {
                  "StringEquals": {
                      "ec2:InstanceType": "m1.medium"
                  }
              },
              "Resource": [
                  "arn:aws:ec2:us-east-1::instance/*",
                  "arn:aws:ec2:us-east-1::image/ami-f1c3e498",
                  "arn:aws:ec2:us-east-1::snapshot/snap-e2f51ffa",
                  "arn:aws:ec2:us-east-1::snapshot/snap-18ca2000",
                  "arn:aws:ec2:us-east-1::key-pair/shenton",
                  "arn:aws:ec2:us-east-1::security-group/sg-6af56d02",
                  "arn:aws:ec2:us-east-1::volume/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>The policy narrows down the exact image, snapshots, security group and key-pair while leaving the specific instance and volume open.</p>
  
  <p>I'm using the CLI tools as follows, as described <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html" rel="noreferrer">here</a>:</p>
  
  <pre><code>aws ec2 run-instances --dry-run \
      --image-id ami-f1c3e498 \
      --key-name shenton \
      --security-group-ids sg-6af56d02 \
      --instance-type m1.medium
  </code></pre>
  
  <p>The <code>~/.aws/config</code> is as follows:</p>
  
  <pre><code>[default]
  output = json
  region = us-east-1
  aws_access_key_id = ...
  aws_secret_access_key = ...
  </code></pre>
  
  <p>The command results in a generic <code>You are not authorized to perform this operation</code> message and the encoded authorization failure message indicates that none of my statements were matched and therefore it rejects the action.</p>
  
  <p>Changing to <code>"Resource": "*"</code> resolves the issue obviously, but I want to gain more understanding as to why the above doesn't work. I fully realize that this involves some degree of guess work, so I welcome any ideas.</p>