title: How can I allow an EC2 instance with an IAM role to set the instance health for itselt, only?
body: <p>I want to allow a script running on my EC2 instance to indicate when it is healthy to the autoscaling group.  To do so, I can run the following from my script:</p>
  
  <pre><code>aws --region $AWSREGION \
    autoscaling \
    set-instance-health \
    --instance-id $(curl http://169.254.169.254/latest/meta-data/instance-id) \
    --health-status Unhealthy
  </code></pre>
  
  <p>Before granting any special permissions to the IAM role, I get the following error (as I'd expect):</p>
  
  <pre><code>An error occurred (AccessDenied) when calling the SetInstanceHealth operation: User: arn:aws:sts::ACCOUNTID:assumed-role/ROLENAME/i-INSTANCEID is not authorized to perform: autoscaling:SetInstanceHealth
  </code></pre>
  
  <p>I could add the following statement to my IAM role to get around this:</p>
  
  <pre><code>{
    "Action": [
      "autoscaling:SetInstanceHealth"
    ],
    "Effect": "Allow",
    "Resource": "*"
  }
  </code></pre>
  
  <p>But wouldn't that allow instances in this role to set instance health on all instances (assuming they know the instance id)?  I wouldn't want one compromised instance being able to take others out of their own ASGs.</p>