ec2:DeleteTags

Tagging

ec2:DeleteTags is a Tagging access-level action in the ec2 service. Grants permission to delete one or more tags from Amazon EC2 resources

Resource types

ARNs that ec2:DeleteTags can be scoped to in an IAM policy.

arn:${Partition}:ec2:${Region}:${Account}:application-status-check/${ApplicationStatusCheckId}

application-status-check

arn:${Partition}:ec2:${Region}:${Account}:capacity-block/${CapacityBlockId}

capacity-block

arn:${Partition}:ec2:${Region}:${Account}:capacity-manager-data-export/${CapacityManagerDataExportId}

capacity-manager-data-export

arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation/${CapacityReservationId}

capacity-reservation

arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation-cancellation-quote/${CapacityReservationCancellationQuoteId}

capacity-reservation-cancellation-quote

arn:${Partition}:ec2:${Region}:${Account}:capacity-reservation-fleet/${CapacityReservationFleetId}

capacity-reservation-fleet

arn:${Partition}:ec2:${Region}:${Account}:carrier-gateway/${CarrierGatewayId}

carrier-gateway

arn:${Partition}:ec2:${Region}:${Account}:client-vpn-endpoint/${ClientVpnEndpointId}

client-vpn-endpoint

arn:${Partition}:ec2:${Region}:${Account}:coip-pool/${Ipv4PoolCoipId}

coip-pool

arn:${Partition}:ec2:${Region}:${Account}:customer-gateway/${CustomerGatewayId}

customer-gateway

arn:${Partition}:ec2:${Region}:${Account}:declarative-policies-report/${DeclarativePoliciesReportId}

declarative-policies-report

arn:${Partition}:ec2:${Region}:${Account}:dedicated-host/${DedicatedHostId}

dedicated-host

arn:${Partition}:ec2:${Region}:${Account}:dhcp-options/${DhcpOptionsId}

dhcp-options

arn:${Partition}:ec2:${Region}:${Account}:egress-only-internet-gateway/${EgressOnlyInternetGatewayId}

egress-only-internet-gateway

arn:${Partition}:ec2:${Region}:${Account}:elastic-gpu/${ElasticGpuId}

elastic-gpu

arn:${Partition}:ec2:${Region}:${Account}:elastic-ip/${AllocationId}

elastic-ip

arn:${Partition}:ec2:${Region}:${Account}:export-image-task/${ExportImageTaskId}

export-image-task

arn:${Partition}:ec2:${Region}:${Account}:export-instance-task/${ExportTaskId}

export-instance-task

arn:${Partition}:ec2:${Region}:${Account}:fleet/${FleetId}

fleet

arn:${Partition}:ec2:${Region}:${Account}:fpga-image/${FpgaImageId}

fpga-image

arn:${Partition}:ec2:${Region}:${Account}:host-reservation/${HostReservationId}

host-reservation

arn:${Partition}:ec2:${Region}::image/${ImageId}

image

arn:${Partition}:ec2:${Region}:${Account}:image-usage-report/${ImageUsageReportId}

image-usage-report

arn:${Partition}:ec2:${Region}:${Account}:import-image-task/${ImportImageTaskId}

import-image-task

arn:${Partition}:ec2:${Region}:${Account}:import-snapshot-task/${ImportSnapshotTaskId}

import-snapshot-task

arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}

instance

arn:${Partition}:ec2:${Region}:${Account}:instance-connect-endpoint/${InstanceConnectEndpointId}

instance-connect-endpoint

arn:${Partition}:ec2:${Region}:${Account}:instance-event-window/${InstanceEventWindowId}

instance-event-window

arn:${Partition}:ec2:${Region}:${Account}:internet-gateway/${InternetGatewayId}

internet-gateway

arn:${Partition}:ec2::${Account}:ipam/${IpamId}

ipam

arn:${Partition}:ec2::${Account}:ipam-external-resource-verification-token/${IpamExternalResourceVerificationTokenId}

ipam-external-resource-verification-token

arn:${Partition}:ec2::${Account}:ipam-internet-registry-association/${IpamInternetRegistryAssociationId}

ipam-internet-registry-association

arn:${Partition}:ec2::${Account}:ipam-policy/${IpamPolicyId}

ipam-policy

arn:${Partition}:ec2::${Account}:ipam-pool/${IpamPoolId}

ipam-pool

arn:${Partition}:ec2:${Region}:${Account}:ipam-pool-allocation/${IpamPoolAllocationId}

ipam-pool-allocation

arn:${Partition}:ec2::${Account}:ipam-prefix-list-resolver/${IpamPrefixListResolverId}

ipam-prefix-list-resolver

arn:${Partition}:ec2::${Account}:ipam-prefix-list-resolver-target/${IpamPrefixListResolverTargetId}

ipam-prefix-list-resolver-target

arn:${Partition}:ec2::${Account}:ipam-resource-discovery/${IpamResourceDiscoveryId}

ipam-resource-discovery

arn:${Partition}:ec2::${Account}:ipam-resource-discovery-association/${IpamResourceDiscoveryAssociationId}

ipam-resource-discovery-association

arn:${Partition}:ec2::${Account}:ipam-scope/${IpamScopeId}

ipam-scope

arn:${Partition}:ec2:${Region}:${Account}:ipv4pool-ec2/${Ipv4PoolEc2Id}

ipv4pool-ec2

arn:${Partition}:ec2:${Region}:${Account}:ipv6pool-ec2/${Ipv6PoolEc2Id}

ipv6pool-ec2

arn:${Partition}:ec2:${Region}:${Account}:key-pair/${KeyPairName}

key-pair

arn:${Partition}:ec2:${Region}:${Account}:launch-template/${LaunchTemplateId}

launch-template

arn:${Partition}:ec2:${Region}:${Account}:local-gateway/${LocalGatewayId}

local-gateway

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table/${LocalGatewayRoutetableId}

local-gateway-route-table

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-virtual-interface-group-association/${LocalGatewayRouteTableVirtualInterfaceGroupAssociationId}

local-gateway-route-table-virtual-interface-group-association

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-vpc-association/${LocalGatewayRouteTableVpcAssociationId}

local-gateway-route-table-vpc-association

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface/${LocalGatewayVirtualInterfaceId}

local-gateway-virtual-interface

arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface-group/${LocalGatewayVirtualInterfaceGroupId}

local-gateway-virtual-interface-group

arn:${Partition}:ec2:${Region}:${Account}:natgateway/${NatGatewayId}

natgateway

arn:${Partition}:ec2:${Region}:${Account}:network-acl/${NaclId}

network-acl

arn:${Partition}:ec2:${Region}:${Account}:network-insights-access-scope/${NetworkInsightsAccessScopeId}

network-insights-access-scope

arn:${Partition}:ec2:${Region}:${Account}:network-insights-access-scope-analysis/${NetworkInsightsAccessScopeAnalysisId}

network-insights-access-scope-analysis

arn:${Partition}:ec2:${Region}:${Account}:network-insights-analysis/${NetworkInsightsAnalysisId}

network-insights-analysis

arn:${Partition}:ec2:${Region}:${Account}:network-insights-path/${NetworkInsightsPathId}

network-insights-path

arn:${Partition}:ec2:${Region}:${Account}:network-interface/${NetworkInterfaceId}

network-interface

arn:${Partition}:ec2:${Region}:${Account}:placement-group/${PlacementGroupName}

placement-group

arn:${Partition}:ec2:${Region}:${Account}:prefix-list/${PrefixListId}

prefix-list

arn:${Partition}:ec2:${Region}:${Account}:replace-root-volume-task/${ReplaceRootVolumeTaskId}

replace-root-volume-task

arn:${Partition}:ec2:${Region}:${Account}:reserved-instances/${ReservationId}

reserved-instances

arn:${Partition}:ec2:${Region}:${Account}:route-server/${RouteServerId}

route-server

arn:${Partition}:ec2:${Region}:${Account}:route-server-endpoint/${RouteServerEndpointId}

route-server-endpoint

arn:${Partition}:ec2:${Region}:${Account}:route-server-peer/${RouteServerPeerId}

route-server-peer

arn:${Partition}:ec2:${Region}:${Account}:route-table/${RouteTableId}

route-table

arn:${Partition}:ec2:${Region}:${Account}:secondary-interface/${SecondaryInterfaceId}

secondary-interface

arn:${Partition}:ec2:${Region}:${Account}:secondary-network/${SecondaryNetworkId}

secondary-network

arn:${Partition}:ec2:${Region}:${Account}:secondary-subnet/${SecondarySubnetId}

secondary-subnet

arn:${Partition}:ec2:${Region}:${Account}:security-group/${SecurityGroupId}

security-group

arn:${Partition}:ec2:${Region}:${Account}:security-group-rule/${SecurityGroupRuleId}

security-group-rule

arn:${Partition}:ec2:${Region}::snapshot/${SnapshotId}

snapshot

arn:${Partition}:ec2:${Region}:${Account}:spot-fleet-request/${SpotFleetRequestId}

spot-fleet-request

arn:${Partition}:ec2:${Region}:${Account}:spot-instances-request/${SpotInstanceRequestId}

spot-instances-request

arn:${Partition}:ec2:${Region}:${Account}:subnet/${SubnetId}

subnet

arn:${Partition}:ec2:${Region}:${Account}:subnet-cidr-reservation/${SubnetCidrReservationId}

subnet-cidr-reservation

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-filter/${TrafficMirrorFilterId}

traffic-mirror-filter

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-filter-rule/${TrafficMirrorFilterRuleId}

traffic-mirror-filter-rule

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-session/${TrafficMirrorSessionId}

traffic-mirror-session

arn:${Partition}:ec2:${Region}:${Account}:traffic-mirror-target/${TrafficMirrorTargetId}

traffic-mirror-target

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway/${TransitGatewayId}

transit-gateway

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-attachment/${TransitGatewayAttachmentId}

transit-gateway-attachment

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-connect-peer/${TransitGatewayConnectPeerId}

transit-gateway-connect-peer

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-metering-policy/${TransitGatewayMeteringPolicyId}

transit-gateway-metering-policy

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-multicast-domain/${TransitGatewayMulticastDomainId}

transit-gateway-multicast-domain

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-policy-table/${TransitGatewayPolicyTableId}

transit-gateway-policy-table

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-route-table/${TransitGatewayRouteTableId}

transit-gateway-route-table

arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-route-table-announcement/${TransitGatewayRouteTableAnnouncementId}

transit-gateway-route-table-announcement

arn:${Partition}:ec2:${Region}:${Account}:verified-access-endpoint/${VerifiedAccessEndpointId}

verified-access-endpoint

arn:${Partition}:ec2:${Region}:${Account}:verified-access-endpoint-target/${VerifiedAccessEndpointTargetId}

verified-access-endpoint-target

arn:${Partition}:ec2:${Region}:${Account}:verified-access-group/${VerifiedAccessGroupId}

verified-access-group

arn:${Partition}:ec2:${Region}:${Account}:verified-access-instance/${VerifiedAccessInstanceId}

verified-access-instance

arn:${Partition}:ec2:${Region}:${Account}:verified-access-policy/${VerifiedAccessPolicyId}

verified-access-policy

arn:${Partition}:ec2:${Region}:${Account}:verified-access-trust-provider/${VerifiedAccessTrustProviderId}

verified-access-trust-provider

arn:${Partition}:ec2:${Region}:${Account}:volume/${VolumeId}

volume

arn:${Partition}:ec2:${Region}:${Account}:vpc/${VpcId}

vpc

arn:${Partition}:ec2:${Region}:${Account}:vpc-block-public-access-exclusion/${VpcBlockPublicAccessExclusionId}

vpc-block-public-access-exclusion

arn:${Partition}:ec2:${Region}:${Account}:vpc-encryption-control/${VpcEncryptionControlId}

vpc-encryption-control

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint/${VpcEndpointId}

vpc-endpoint

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-connection/${VpcEndpointConnectionId}

vpc-endpoint-connection

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-service/${VpcEndpointServiceId}

vpc-endpoint-service

arn:${Partition}:ec2:${Region}:${Account}:vpc-endpoint-service-permission/${VpcEndpointServicePermissionId}

vpc-endpoint-service-permission

arn:${Partition}:ec2:${Region}:${Account}:vpc-flow-log/${VpcFlowLogId}

vpc-flow-log

arn:${Partition}:ec2:${Region}:${Account}:vpc-peering-connection/${VpcPeeringConnectionId}

vpc-peering-connection

arn:${Partition}:ec2:${Region}:${Account}:vpn-concentrator/${VpnConcentratorId}

vpn-concentrator

arn:${Partition}:ec2:${Region}:${Account}:vpn-connection/${VpnConnectionId}

vpn-connection

arn:${Partition}:ec2:${Region}:${Account}:vpn-gateway/${VpnGatewayId}

vpn-gateway

Condition keys

Keys you can use in the Condition block of a policy that grants ec2:DeleteTags.

aws:TagKeys ArrayOfString

Filters access by a list of tag keys that are allowed in the request

ec2:Region String

Filters access by the name of the AWS Region

aws:RequestTag/${TagKey} String

Filters access by a tag key and value pair that is allowed in the request

aws:ResourceTag/${TagKey} String

Filters access by a tag key and value pair of a resource

ec2:ResourceTag/${TagKey} String

Filters access by a tag key and value pair of a resource

Example IAM policy

A minimal policy that allows ec2:DeleteTags. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEc2DeleteTags",
      "Effect": "Allow",
      "Action": "ec2:DeleteTags",
      "Resource": "*"
    }
  ]
}

Related actions in ec2

ec2:AcceptAddressTransfer Write ec2:AcceptCapacityReservationBillingOwnership Write ec2:AcceptReservedInstancesExchangeQuote Write ec2:AcceptTransitGatewayClientVpnAttachment Write ec2:AcceptTransitGatewayMulticastDomainAssociations Write ec2:AcceptTransitGatewayPeeringAttachment Write ec2:AcceptTransitGatewayVpcAttachment Write ec2:AcceptVpcEndpointConnections Write ec2:AcceptVpcPeeringConnection Write ec2:AdvertiseByoipCidr Write ec2:AllocateAddress Write ec2:AllocateHosts Write

View all ec2 actions →