ec2:WithdrawByoipCidr is a Write access-level action in the ec2 service. Grants permission to stop advertising an address range that was provisioned for use in AWS through bring your own IP addresses (BYOIP)
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows ec2:WithdrawByoipCidr. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowEc2WithdrawByoipCidr",
"Effect": "Allow",
"Action": "ec2:WithdrawByoipCidr",
"Resource": "*"
}
]
}