AWS describe-instances limiting to tagged

amazon ec2amazon-iamamazon-web-servicesaws-cli

With the following policy in AWS IAM:

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/project": "projectA"
                }
            },
            "Resource": [
                "arn:aws:ec2:your_region:your_account_ID:instance/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": [
                "arn:aws:ec2:eu-west-1:REMOVED:instance/i-REMOVED"
            ]
        }
    ]
}

I'm able to start/stop based on the resource set to a specific instance ID. The action of DescribeInstances, on the other hand, which I would like to limit to EC2 assets tagged with "project=projectA" doesn't seem to work.

I've tried to list them with aws cli as:

aws ec2 describe-instances --filters Name=tag:project,Values=projectA

And the tag is in fact added to the EC2 asset in question.

Any tips/recommendations?

P.S.: I've also tried setting the resource in the describeinstances part as *, and still no go.

Best Answer

Closing this question, as it appears that conditions are not supported by DescribeInstances.

No resource limiting is permitted by DescribeInstances (tags, specific instances IDs, etc).

Related Topic