ec2:LockSnapshot is a Write access-level action in the ec2 service. Grants permission to lock an Amazon EBS snapshot in either governance or compliance mode to protect it against accidental or malicious deletions
ARNs that ec2:LockSnapshot can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ec2:LockSnapshot.
Filters access by the name of the AWS Region
Filters access by a tag key and value pair of a resource
Filters access by whether the EBS volume is encrypted
Filters access by the owner of the resource (amazon, aws-marketplace, or an AWS account ID)
Filters access by the ARN of the parent volume from which the snapshot was created
Filters access by a tag key and value pair of a resource
Filters access by the compliance mode cooling-off period
Filters access by the ID of a snapshot
Filters access by the snapshot lock duration
Filters access by the initiation time of a snapshot
Filters access by the size of the volume, in GiB
A minimal policy that allows ec2:LockSnapshot. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowEc2LockSnapshot",
"Effect": "Allow",
"Action": "ec2:LockSnapshot",
"Resource": "*"
}
]
}