title: Insufficient privileges for `run-instance` when enabling InstanceMetadataTags
body: <p>I have a problem where I can't understand why it works like that.</p>
  <p>I have a CloudFormation template, which give the following access rights:</p>
  <pre><code>- Effect: Allow
    Action:
      - ec2:RunInstances
      - ec2:ModifyInstanceAttribute
    Resource:
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':instance/*']]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':key-pair/*']]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':security-group/', Ref: DBSecurityGroup ]]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':volume/*']]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':network-interface/**']]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':subnet/', Ref: Subnet ]]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:' ,Ref: 'AWS::Region', ':',Ref: 'AWS::AccountId', ':placement-group/*']]
      - 'Fn::Join': [ '', [ 'arn:aws:ec2:',Ref: 'AWS::Region', '::image/ami-**']]
  </code></pre>
  <p>to the machines.</p>
  <p>The machines can call <code>run-instances</code> using this role, everything works fine.</p>
  <p>If I enable meta-data tags, like this:</p>
  <pre><code>  InstanceEnableTagsMetadata:
      Type: 'AWS::EC2::LaunchTemplate'
      Properties:
        LaunchTemplateData:
          MetadataOptions:
            InstanceMetadataTags: enabled
  </code></pre>
  <p><code>run-instance</code> calls stop working with insufficient privileges.</p>
  <p>Error messages looks like this:</p>
  <pre><code>API: ec2:RunInstances You are not authorized to perform this operation. Encoded authorization failure message: OTMSE3dUu3XO...
  </code></pre>
  <p>What could be the problem?</p>