Answers: <p><strong>quick answer</strong>: - The user will need the permissions to execute the  <a href="https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html" rel="nofollow noreferrer">ec2 run-instances</a> command.</p>
  <p>Explanation on how to do this:</p>
  <p>First create a policy (not Role) that authorizes the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html" rel="nofollow noreferrer">EC2 RunInstances action</a> (find it in the table in the middle of the link).  The EC2 RunInstances action requires access to many resources and you need to define which resources to maintain <a href="https://en.wikipedia.org/wiki/Principle_of_least_privilege" rel="nofollow noreferrer">least privileges</a>.</p>
  <p>Review this <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-runinstances" rel="nofollow noreferrer">AWS document</a> explaining RunInstances and resource permissions needed.  It also includes some example policies.</p>
  <p>Note:  AWS doesn't allow <a href="https://stackoverflow.com/questions/55222570/can-roles-be-assigned-to-users-and-groups-in-aws">attaching roles directly to users</a>.  Instead, the user would to assume the role where you have added your new policy to that role, or the user would be added to an iam user group that had your new policy added to the permission policies.</p>
  <p>======</p>
  <p>To double check this works, I followed these steps:</p>
  <ol>
  <li>Created a simple iam user with cli access: userX</li>
  <li>Created a new iam policy using the visual editor that can access RunInstances action with any resource (<a href="https://en.wikipedia.org/wiki/Principle_of_least_privilege" rel="nofollow noreferrer">not recommended</a> for you in production, but ok for testing) : EC2RunInstancesAllResourcesPolicy
  <a href="https://i.sstatic.net/IPoYz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/IPoYz.png" alt="enter image description here" /></a></li>
  <li>Created an iam user group: RunInstanceAdminGroup</li>
  <li>Added EC2RunInstancesAllResourcesPolicy to the RunInstanceAdminGroup user group</li>
  <li>Added userX to the RunInstanceAdminGroup</li>
  <li>ran the ec2 run-instances command from the cli using userX credentials and it succeeded!</li>
  </ol>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-14T18:48:38.947Z
Answers: 2021-11-15T12:10:40.997Z
Answers: 2021-11-15T12:10:40.997Z
Answers: Taterhead
Body: <p>I want to provision an EC2 instance with Ansible. So for that purpose I want to create a separate IAM user to keep things clear.</p>
  <p>I can assign the full EC2 access to the user. But I don't want any other part of my account be affected if something bad happens.</p>
  <p>What roles do I need to attach to the IAM user to be able to provision instances?</p>
  
Tags: <amazon-web-services><ansible><amazon-ec2><aws-iam><provisioning>
Title: What are minimum permissions required for an IAM user to provision EC2 instances?
UserDisplayName: Santosh Kumar
ThreadText: # What are minimum permissions required for an IAM user to provision EC2 instances?
  
  (Asked by: username_0 on 2021-11-12)
  
  I want to provision an EC2 instance with Ansible. So for that purpose I want to create a separate IAM user to keep things clear.
  
  I can assign the full EC2 access to the user. But I don't want any other part of my account be affected if something bad happens.
  
  What roles do I need to attach to the IAM user to be able to provision instances?
  
  **Tags:** amazon-web-services, ansible, amazon-ec2, aws-iam, provisioning
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-11-14. Score: 1
  
  **quick answer**: - The user will need the permissions to execute the [ec2 run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command.
  
  Explanation on how to do this:
  
  First create a policy (not Role) that authorizes the [EC2 RunInstances action](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html) (find it in the table in the middle of the link). The EC2 RunInstances action requires access to many resources and you need to define which resources to maintain [least privileges](https://en.wikipedia.org/wiki/Principle_of_least_privilege).
  
  Review this [AWS document](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-runinstances) explaining RunInstances and resource permissions needed. It also includes some example policies.
  
  Note: AWS doesn't allow [attaching roles directly to users](https://stackoverflow.com/questions/55222570/can-roles-be-assigned-to-users-and-groups-in-aws). Instead, the user would to assume the role where you have added your new policy to that role, or the user would be added to an iam user group that had your new policy added to the permission policies.
  
  ======
  
  To double check this works, I followed these steps:
  
  1. Created a simple iam user with cli access: userX
  2. Created a new iam policy using the visual editor that can access RunInstances action with any resource ([not recommended](https://en.wikipedia.org/wiki/Principle_of_least_privilege) for you in production, but ok for testing) : EC2RunInstancesAllResourcesPolicy
     [![enter image description here](https://i.sstatic.net/IPoYz.png)](https://i.sstatic.net/IPoYz.png)
  3. Created an iam user group: RunInstanceAdminGroup
  4. Added EC2RunInstancesAllResourcesPolicy to the RunInstanceAdminGroup user group
  5. Added userX to the RunInstanceAdminGroup
  6. ran the ec2 run-instances command from the cli using userX credentials and it succeeded!
  
  
  ---
  
  