ec2:CreateTags

Tagging

ec2:CreateTags is a Tagging access-level action in the ec2 service. Grants permission to add or overwrite one or more tags for Amazon EC2 resources

Resource types

ARNs that ec2:CreateTags can be scoped to in an IAM policy.

arn:${Partition}:ec2:${Region}:${Account}:capacity-block/${CapacityBlockId}

capacity-block

arn:${Partition}:ec2:${Region}:${Account}:capacity-manager-data-export/${CapacityManagerDataExportId}

capacity-manager-data-export

arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation/${CapacityReservationId}

capacity-reservation

arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation-cancellation-quote/${CapacityReservationCancellationQuoteId}

capacity-reservation-cancellation-quote

arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation-fleet/${CapacityReservationFleetId}

capacity-reservation-fleet

arn:${Partition}:ec2:${Region}:${Account}:carrier-gateway/${CarrierGatewayId}

carrier-gateway

arn:${Partition}:ec2:${Region}:${Account}:client-vpn-endpoint/${ClientVpnEndpointId}

client-vpn-endpoint

arn:${Partition}:ec2:${Region}:${Account}:coip-pool/${Ipv4PoolCoipId}

coip-pool

arn:${Partition}:ec2:${Region}:${Account}:customer-gateway/${CustomerGatewayId}

customer-gateway

arn:${Partition}:ec2:${Region}:${Account}:declarative-policies-report/${DeclarativePoliciesReportId}

declarative-policies-report

arn:${Partition}:ec2:${Region}:${Account}:dedicated-host/${DedicatedHostId}

dedicated-host

arn:${Partition}:ec2:${Region}:${Account}:dhcp-options/${DhcpOptionsId}

dhcp-options

arn:${Partition}:ec2:${Region}:${Account}:egress-only-internet-gateway/${EgressOnlyInternetGatewayId}

egress-only-internet-gateway

arn:${Partition}:ec2:${Region}:${Account}:elastic-gpu/${ElasticGpuId}

elastic-gpu

arn:${Partition}:ec2:${Region}:${Account}:elastic-ip/${AllocationId}

elastic-ip

arn:${Partition}:ec2:${Region}:${Account}:export-image-task/${ExportImageTaskId}

export-image-task

arn:${Partition}:ec2:${Region}:${Account}:export-instance-task/${ExportTaskId}

export-instance-task

arn:${Partition}:ec2:${Region}:${Account}:fleet/${FleetId}

fleet

arn:${Partition}:ec2:${Region}:${Account}:fpga-image/${FpgaImageId}

fpga-image

arn:${Partition}:ec2:${Region}:${Account}:host-reservation/${HostReservationId}

host-reservation

arn:${Partition}:ec2:${Region}::image/${ImageId}

image

arn:${Partition}:ec2:${Region}:${Account}:image-usage-report/${ImageUsageReportId}

image-usage-report

arn:${Partition}:ec2:${Region}:${Account}:import-image-task/${ImportImageTaskId}

import-image-task

arn:${Partition}:ec2:${Region}:${Account}:import-snapshot-task/${ImportSnapshotTaskId}

import-snapshot-task

arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}

instance

arn:${Partition}:ec2:${Region}:${Account}:instance-connect-endpoint/${InstanceConnectEndpointId}

instance-connect-endpoint

arn:${Partition}:ec2:${Region}:${Account}:instance-event-window/${InstanceEventWindowId}

instance-event-window

arn:${Partition}:ec2:${Region}:${Account}:internet-gateway/${InternetGatewayId}

internet-gateway

arn:${Partition}:ec2::${Account}:ipam/${IpamId}

ipam

arn:${Partition}:ec2::${Account}:ipam-external-resource-verification-token/${IpamExternalResourceVerificationTokenId}

ipam-external-resource-verification-token

arn:${Partition}:ec2::${Account}:ipam-policy/${IpamPolicyId}

ipam-policy

arn:${Partition}:ec2::${Account}:ipam-pool/${IpamPoolId}

ipam-pool

arn:${Partition}:ec2:${Region}:${Account}:ipam-pool-allocation/${IpamPoolAllocationId}

ipam-pool-allocation

arn:${Partition}:ec2::${Account}:ipam-prefix-list-resolver/${IpamPrefixListResolverId}

ipam-prefix-list-resolver

arn:${Partition}:ec2::${Account}:ipam-prefix-list-resolver-target/${IpamPrefixListResolverTargetId}

ipam-prefix-list-resolver-target

arn:${Partition}:ec2::${Account}:ipam-resource-discovery/${IpamResourceDiscoveryId}

ipam-resource-discovery

arn:${Partition}:ec2::${Account}:ipam-resource-discovery-association/${IpamResourceDiscoveryAssociationId}

ipam-resource-discovery-association

arn:${Partition}:ec2::${Account}:ipam-scope/${IpamScopeId}

ipam-scope

arn:${Partition}:ec2:${Region}:${Account}:ipv4pool-ec2/${Ipv4PoolEc2Id}

ipv4pool-ec2

arn:${Partition}:ec2:${Region}:${Account}:ipv6pool-ec2/${Ipv6PoolEc2Id}

ipv6pool-ec2

arn:${Partition}:ec2:${Region}:${Account}:key-pair/${KeyPairName}

key-pair

arn:${Partition}:ec2:${Region}:${Account}:launch-template/${LaunchTemplateId}

launch-template

arn:${Partition}:ec2:${Region}:${Account}:local-gateway/${LocalGatewayId}

local-gateway

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table/${LocalGatewayRoutetableId}

local-gateway-route-table

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-virtual-interface-group-association/${LocalGatewayRouteTableVirtualInterfaceGroupAssociationId}

local-gateway-route-table-virtual-interface-group-association

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-vpc-association/${LocalGatewayRouteTableVpcAssociationId}

local-gateway-route-table-vpc-association

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface/${LocalGatewayVirtualInterfaceId}

local-gateway-virtual-interface

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface-group/${LocalGatewayVirtualInterfaceGroupId}

local-gateway-virtual-interface-group

arn:${Partition}:ec2:${Region}:${Account}:natgateway/${NatGatewayId}

natgateway

arn:${Partition}:ec2:${Region}:${Account}:network-acl/${NaclId}

network-acl

arn:${Partition}:ec2:${Region}:${Account}:network-insights-access-scope/${NetworkInsightsAccessScopeId}

network-insights-access-scope

arn:${Partition}:ec2:${Region}:${Account}:network-insights-access-scope-analysis/${NetworkInsightsAccessScopeAnalysisId}

network-insights-access-scope-analysis

arn:${Partition}:ec2:${Region}:${Account}:network-insights-analysis/${NetworkInsightsAnalysisId}

network-insights-analysis

arn:${Partition}:ec2:${Region}:${Account}:network-insights-path/${NetworkInsightsPathId}

network-insights-path

arn:${Partition}:ec2:${Region}:${Account}:network-interface/${NetworkInterfaceId}

network-interface

arn:${Partition}:ec2:${Region}:${Account}:placement-group/${PlacementGroupName}

placement-group

arn:${Partition}:ec2:${Region}:${Account}:prefix-list/${PrefixListId}

prefix-list

arn:${Partition}:ec2:${Region}:${Account}:replace-root-volume-task/${ReplaceRootVolumeTaskId}

replace-root-volume-task

arn:${Partition}:ec2:${Region}:${Account}:reserved-instances/${ReservationId}

reserved-instances

arn:${Partition}:ec2:${Region}:${Account}:route-server/${RouteServerId}

route-server

arn:${Partition}:ec2:${Region}:${Account}:route-server-endpoint/${RouteServerEndpointId}

route-server-endpoint

arn:${Partition}:ec2:${Region}:${Account}:route-server-peer/${RouteServerPeerId}

route-server-peer

arn:${Partition}:ec2:${Region}:${Account}:route-table/${RouteTableId}

route-table

arn:${Partition}:ec2:${Region}:${Account}:secondary-interface/${SecondaryInterfaceId}

secondary-interface

arn:${Partition}:ec2:${Region}:${Account}:secondary-network/${SecondaryNetworkId}

secondary-network

arn:${Partition}:ec2:${Region}:${Account}:secondary-subnet/${SecondarySubnetId}

secondary-subnet

arn:${Partition}:ec2:${Region}:${Account}:security-group/${SecurityGroupId}

security-group

arn:${Partition}:ec2:${Region}:${Account}:security-group-rule/${SecurityGroupRuleId}

security-group-rule

arn:${Partition}:ec2:${Region}::snapshot/${SnapshotId}

snapshot

arn:${Partition}:ec2:${Region}:${Account}:spot-fleet-request/${SpotFleetRequestId}

spot-fleet-request

arn:${Partition}:ec2:${Region}:${Account}:spot-instances-request/${SpotInstanceRequestId}

spot-instances-request

arn:${Partition}:ec2:${Region}:${Account}:subnet/${SubnetId}

subnet

arn:${Partition}:ec2:${Region}:${Account}:subnet-cidr-reservation/${SubnetCidrReservationId}

subnet-cidr-reservation

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-filter/${TrafficMirrorFilterId}

traffic-mirror-filter

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-filter-rule/${TrafficMirrorFilterRuleId}

traffic-mirror-filter-rule

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-session/${TrafficMirrorSessionId}

traffic-mirror-session

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-target/${TrafficMirrorTargetId}

traffic-mirror-target

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway/${TransitGatewayId}

transit-gateway

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-attachment/${TransitGatewayAttachmentId}

transit-gateway-attachment

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-connect-peer/${TransitGatewayConnectPeerId}

transit-gateway-connect-peer

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-metering-policy/${TransitGatewayMeteringPolicyId}

transit-gateway-metering-policy

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-multicast-domain/${TransitGatewayMulticastDomainId}

transit-gateway-multicast-domain

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-policy-table/${TransitGatewayPolicyTableId}

transit-gateway-policy-table

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-route-table/${TransitGatewayRouteTableId}

transit-gateway-route-table

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-route-table-announcement/${TransitGatewayRouteTableAnnouncementId}

transit-gateway-route-table-announcement

arn:${Partition}:ec2:${Region}:${Account}:verified-access-endpoint/${VerifiedAccessEndpointId}

verified-access-endpoint

arn:${Partition}:ec2:${Region}:${Account}:verified-access-endpoint-target/${VerifiedAccessEndpointTargetId}

verified-access-endpoint-target

arn:${Partition}:ec2:${Region}:${Account}:verified-access-group/${VerifiedAccessGroupId}

verified-access-group

arn:${Partition}:ec2:${Region}:${Account}:verified-access-instance/${VerifiedAccessInstanceId}

verified-access-instance

arn:${Partition}:ec2:${Region}:${Account}:verified-access-policy/${VerifiedAccessPolicyId}

verified-access-policy

arn:${Partition}:ec2:${Region}:${Account}:verified-access-trust-provider/${VerifiedAccessTrustProviderId}

verified-access-trust-provider

arn:${Partition}:ec2:${Region}:${Account}:volume/${VolumeId}

volume

arn:${Partition}:ec2:${Region}:${Account}:vpc/${VpcId}

vpc

arn:${Partition}:ec2:${Region}:${Account}:vpc-block-public-access-exclusion/${VpcBlockPublicAccessExclusionId}

vpc-block-public-access-exclusion

arn:${Partition}:ec2:${Region}:${Account}:vpc-encryption-control/${VpcEncryptionControlId}

vpc-encryption-control

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint/${VpcEndpointId}

vpc-endpoint

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-connection/${VpcEndpointConnectionId}

vpc-endpoint-connection

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-service/${VpcEndpointServiceId}

vpc-endpoint-service

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-service-permission/${VpcEndpointServicePermissionId}

vpc-endpoint-service-permission

arn:${Partition}:ec2:${Region}:${Account}:vpc-flow-log/${VpcFlowLogId}

vpc-flow-log

arn:${Partition}:ec2:${Region}:${Account}:vpc-peering-connection/${VpcPeeringConnectionId}

vpc-peering-connection

arn:${Partition}:ec2:${Region}:${Account}:vpn-concentrator/${VpnConcentratorId}

vpn-concentrator

arn:${Partition}:ec2:${Region}:${Account}:vpn-connection/${VpnConnectionId}

vpn-connection

arn:${Partition}:ec2:${Region}:${Account}:vpn-gateway/${VpnGatewayId}

vpn-gateway

Condition keys

Keys you can use in the Condition block of a policy that grants ec2:CreateTags.

ec2:SnapshotTime String

Filters access by the initiation time of a snapshot

ec2:VpceSupportedRegion String

Filters access by the supported region of the VPC endpoint service

ec2:transitGatewayAttachmentId String

Filters access by the ID of a transit gateway attachment

ec2:transitGatewayConnectPeerId String

Filters access by the ID of a transit gateway connect peer

ec2:transitGatewayId String

Filters access by the ID of a transit gateway

ec2:transitGatewayMeteringPolicyId String

Filters access by the ID of a metering policy id

ec2:transitGatewayMulticastDomainId String

Filters access by the ID of a transit gateway multicast domain

ec2:transitGatewayPolicyTableId String

Filters access by the ID of a transit gateway policy table

ec2:transitGatewayRouteTableAnnouncementId String

Filters access by the ID of a transit gateway route table announcement

ec2:transitGatewayRouteTableId String

Filters access by the ID of a transit gateway route table

aws:RequestTag/${TagKey} String

Filters access by a tag key and value pair that is allowed in the request

aws:ResourceTag/${TagKey} String

Filters access by a tag key and value pair of a resource

aws:TagKeys ArrayOfString

Filters access by a list of tag keys that are allowed in the request

ec2:AccepterVpc ARN

Filters access by the ARN of an accepter VPC in a VPC peering connection

ec2:Add/group String

Filters access by the group being added to a snapshot

ec2:Add/userId String

Filters access by the account id being added to a snapshot

ec2:AllocationId String

Filters access by the allocation ID of the Elastic IP address

ec2:AssociatePublicIpAddress Bool

Filters access by whether the user wants to associate a public IP address with the instance

ec2:Attribute String

Filters access by an attribute of a resource

ec2:Attribute/${AttributeName} String

Filters access by an attribute being set on a resource

ec2:AuthenticationType String

Filters access by the authentication type for the VPN tunnel endpoints

ec2:AuthorizedService String

Filters access by the AWS service that has permission to use a resource

ec2:AuthorizedUser String

Filters access by an IAM principal that has permission to use a resource

ec2:AutoPlacement String

Filters access by the Auto Placement properties of a Dedicated Host

ec2:AvailabilityZone String

Filters access by the name of an Availability Zone in an AWS Region

ec2:AvailabilityZoneId String

Filters access by the ID of an Availability Zone in an AWS Region

ec2:CapacityReservationFleet ARN

Filters access by the ARN of the Capacity Reservation Fleet

ec2:ClientRootCertificateChainArn ARN

Filters access by the ARN of the client root certificate chain

ec2:CloudwatchLogGroupArn ARN

Filters access by the ARN of the CloudWatch Logs log group

ec2:CloudwatchLogStreamArn ARN

Filters access by the ARN of the CloudWatch Logs log stream

ec2:CommitmentDuration Numeric

Filters access by commitment duration of the Capacity Reservation

ec2:CpuOptionsAmdSevSnp String

Filters access by the state of AMD SEV-SNP CPU Options. Currently, only US East (Ohio) and Europe (Ireland) are supported

ec2:CreateDate Date

Filters access by the date and time at which the Capacity Reservation was created

ec2:DPDTimeoutSeconds Numeric

Filters access by the duration after which DPD timeout occurs on a VPN tunnel

ec2:DestinationCapacityReservationId ARN

Filters access by the ID of the Capacity Reservation that you want to move capacity into

ec2:DhcpOptionsID String

Filters access by the ID of a dynamic host configuration protocol (DHCP) options set

ec2:Phase1LifetimeSeconds Numeric

Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel

ec2:DirectoryArn ARN

Filters access by the ARN of the directory

ec2:Phase2DHGroup ArrayOfString

Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations

ec2:Domain String

Filters access by the domain of the Elastic IP address

ec2:Phase2EncryptionAlgorithms ArrayOfString

Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations

ec2:EbsOptimized Bool

Filters access by whether the instance is enabled for EBS optimization

ec2:Phase2IntegrityAlgorithms ArrayOfString

Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations

ec2:ElasticGpuType String

Filters access by the type of Elastic Graphics accelerator

ec2:Phase2LifetimeSeconds Numeric

Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel

ec2:Encrypted Bool

Filters access by whether the EBS volume is encrypted

ec2:PlacementGroup ARN

Filters access by the ARN of the placement group

ec2:EndDate Date

Filters access by the date and time at which the Capacity Reservation ends

ec2:PlacementGroupName String

Filters access by the name of a placement group

ec2:EndDateType String

Filters access by the way in which the Capacity Reservation ends

ec2:PlacementGroupStrategy String

Filters access by the instance placement strategy used by the placement group (cluster, spread, or partition)

ec2:EphemeralStorage Bool

Filters access by whether the instance is enabled for ephemeral storage

ec2:ProductCode String

Filters access by the product code that is associated with the AMI

ec2:Public Bool

Filters access by whether the image has public launch permissions

ec2:PublicIpAddress String

Filters access by a public IP address

ec2:GatewayType String

Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection

ec2:Quantity Numeric

Filters access by the number of Dedicated Hosts in a request

ec2:HostRecovery String

Filters access by whether host recovery is enabled for a Dedicated Host

ec2:Region String

Filters access by the name of the AWS Region

ec2:IKEVersions ArrayOfString

Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel

ec2:RekeyFuzzPercentage Numeric

Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel

ec2:ImageID String

Filters access by the ID of an image

ec2:RekeyMarginTimeSeconds Numeric

Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel

ec2:ImageType String

Filters access by the type of image (machine, aki, or ari)

ec2:Remove/group String

Filters access by the group being removed from a snapshot

ec2:InsideTunnelCidr String

Filters access by the range of inside IP addresses for a VPN tunnel

ec2:Remove/userId String

Filters access by the account id being removed from a snapshot

ec2:InsideTunnelIpv6Cidr String

Filters access by a range of inside IPv6 addresses for a VPN tunnel

ec2:ReplayWindowSizePackets String

Filters access by the number of packets in an IKE replay window

ec2:InstanceAutoRecovery String

Filters access by whether the instance type supports auto recovery

ec2:RequesterVpc ARN

Filters access by the ARN of a requester VPC in a VPC peering connection

ec2:InstanceBandwidthWeighting String

Filters access by the bandwidth weighting of an instance

ec2:ReservedInstancesOfferingType String

Filters access by the payment option of the Reserved Instance offering (No Upfront, Partial Upfront, or All Upfront)

ec2:InstanceCount Numeric

Filters access by the number of instances

ec2:ResourceTag/${TagKey} String

Filters access by a tag key and value pair of a resource

ec2:InstanceID String

Filters access by the ID of an instance

ec2:InstanceMarketType String

Filters access by the market or purchasing option of an instance (capacity-block, on-demand, or spot)

ec2:RootDeviceType String

Filters access by the root device type of the instance (ebs or instance-store)

ec2:InstanceMatchCriteria String

Filters access by the type of instance launches that the Capacity Reservation accepts

ec2:RouteTableID String

Filters access by the ID of a route table

ec2:InstanceMetadataTags String

Filters access by whether the instance allows access to instance tags from the instance metadata

ec2:RoutingType String

Filters access by the routing type for the VPN connection

ec2:InstancePlatform ARN

Filters access by the type of operating system for which the Capacity Reservation reserves capacity

ec2:SamlProviderArn ARN

Filters access by the ARN of the IAM SAML identity provider

ec2:InstanceProfile ARN

Filters access by the ARN of an instance profile

ec2:SecurityGroupID String

Filters access by the ID of a security group

ec2:InstanceType String

Filters access by the type of instance

ec2:ServerCertificateArn ARN

Filters access by the ARN of the server certificate

ec2:InternetGatewayID String

Filters access by the ID of an internet gateway

ec2:SnapshotCoolOffPeriod Numeric

Filters access by the compliance mode cooling-off period

ec2:InterruptibleCapacityReservationId String

Filters access by the ID of an interruptible Capacity Reservation

ec2:SnapshotID String

Filters access by the ID of a snapshot

ec2:InterruptionType String

Filters access by the type of interruption

ec2:SnapshotLockDuration Numeric

Filters access by the snapshot lock duration

ec2:IpamPrefixListResolverTargetId String

Filters access by the IPAM prefix list resolver target ID that is syncing CIDRs to a managed prefix list

ec2:Ipv4IpamPoolId String

Filters access by the ID of an IPAM pool provided for IPv4 CIDR block allocation

ec2:SourceAvailabilityZone String

Filters access by the name of the Availability Zone from which the request originated

ec2:Ipv6IpamPoolId String

Filters access by the ID of an IPAM pool provided for IPv6 CIDR block allocation

ec2:SourceCapacityReservationId ARN

Filters access by the ID of the Capacity Reservation from which you want to move capacity

ec2:IsInterruptible Bool

Filters access by whether Capacity Reservations are interruptible

ec2:IsLaunchTemplateResource Bool

Filters access by whether users are able to override resources that are specified in the launch template

ec2:SourceOutpostArn ARN

Filters access by the ARN of the Outpost from which the request originated

ec2:KeyPairName String

Filters access by the name of a key pair

ec2:Subnet ARN

Filters access by the ARN of the subnet

ec2:KeyPairType String

Filters access by the type of a key pair

ec2:SubnetID String

Filters access by the ID of a subnet

ec2:KmsKeyId String

Filters access by the ID of an AWS KMS key provided in the request

ec2:TargetInstanceCount Numeric

Filters access by the number of instances the interruptible Capacity Reservation is assigned

ec2:LaunchTemplate ARN

Filters access by the ARN of a launch template

ec2:Tenancy String

Filters access by the tenancy of the VPC or instance (default, dedicated, or host)

ec2:Location String

Filters access by the destination for the snapshot copy

ec2:VolumeID String

Filters access by the ID of a volume

ec2:ManagedResourceOperator String

Filters access by the presence of an EC2 operator provisioning a managed resource

ec2:VolumeInitializationRate Numeric

Filters access by the initialization rate of the volume, in MiBps

ec2:MetadataHttpEndpoint String

Filters access by whether the HTTP endpoint is enabled for the instance metadata service

ec2:VolumeIops Numeric

Filters access by the the number of input/output operations per second (IOPS) provisioned for the volume

ec2:MetadataHttpPutResponseHopLimit Numeric

Filters access by the allowed number of hops when calling the instance metadata service

ec2:VolumeSize Numeric

Filters access by the size of the volume, in GiB

ec2:MetadataHttpTokens String

Filters access by whether tokens are required when calling the instance metadata service (optional or required)

ec2:VolumeThroughput Numeric

Filters access by the throughput of the volume, in MiBps

ec2:NetworkAclID String

Filters access by the ID of a network access control list (ACL)

ec2:VolumeType String

Filters access by the type of volume (gp2, gp3, io1, io2, st1, sc1, or standard)

ec2:NetworkInterfaceID String

Filters access by the ID of an elastic network interface

ec2:Vpc ARN

Filters access by the ARN of the VPC

ec2:NewInstanceProfile ARN

Filters access by the ARN of the instance profile being attached

ec2:VpcID String

Filters access by the ID of a virtual private cloud (VPC)

ec2:OutpostArn ARN

Filters access by the ARN of the Outpost

ec2:VpcPeeringConnectionID String

Filters access by the ID of a VPC peering connection

ec2:Owner String

Filters access by the owner of the resource (amazon, aws-marketplace, or an AWS account ID)

ec2:VpceMultiRegion String

Filters access by multi region of the VPC endpoint service

ec2:ParentSnapshot ARN

Filters access by the ARN of the parent snapshot

ec2:VpcePrivateDnsPreference String

Filters access by the private DNS preference

ec2:ParentVolume ARN

Filters access by the ARN of the parent volume from which the snapshot was created

ec2:VpcePrivateDnsSpecifiedDomains ArrayOfString

Filters access by the private DNS domains

ec2:Permission String

Filters access by the type of permission for a resource (INSTANCE-ATTACH or EIP-ASSOCIATE)

ec2:VpceServiceName String

Filters access by the name of the VPC endpoint service

ec2:Phase1DHGroup ArrayOfString

Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations

ec2:VpceServiceOwner String

Filters access by the service owner of the VPC endpoint service (amazon, aws-marketplace, or an AWS account ID)

ec2:Phase1EncryptionAlgorithms ArrayOfString

Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations

ec2:VpceServicePrivateDnsName String

Filters access by the private DNS name of the VPC endpoint service

ec2:Phase1IntegrityAlgorithms ArrayOfString

Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations

ec2:VpceServiceRegion String

Filters access by the region of the VPC endpoint service

Example IAM policy

A minimal policy that allows ec2:CreateTags. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEc2CreateTags",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": "*"
    }
  ]
}

Related actions in ec2

ec2:AcceptAddressTransfer Write ec2:AcceptCapacityReservationBillingOwnership Write ec2:AcceptReservedInstancesExchangeQuote Write ec2:AcceptTransitGatewayClientVpnAttachment Write ec2:AcceptTransitGatewayMulticastDomainAssociations Write ec2:AcceptTransitGatewayPeeringAttachment Write ec2:AcceptTransitGatewayVpcAttachment Write ec2:AcceptVpcEndpointConnections Write ec2:AcceptVpcPeeringConnection Write ec2:AdvertiseByoipCidr Write ec2:AllocateAddress Write ec2:AllocateHosts Write

View all ec2 actions →