ec2:ReplaceNetworkAclAssociation is a Write access-level action in the ec2 service. Grants permission to change which network ACL a subnet is associated with
ARNs that ec2:ReplaceNetworkAclAssociation can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ec2:ReplaceNetworkAclAssociation.
Filters access by the name of the AWS Region
Filters access by a tag key and value pair of a resource
Filters access by the ID of a network access control list (ACL)
Filters access by a tag key and value pair of a resource
Filters access by the ARN of the VPC
Filters access by the name of an Availability Zone in an AWS Region
Filters access by the ID of an Availability Zone in an AWS Region
Filters access by the ID of a subnet
A minimal policy that allows ec2:ReplaceNetworkAclAssociation. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowEc2ReplaceNetworkAclAssociation",
"Effect": "Allow",
"Action": "ec2:ReplaceNetworkAclAssociation",
"Resource": "*"
}
]
}