title: aws ec2 describe-instances IAM role does not work
body: <p>My EC2 instance has a IAM role below.</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "~~~~",
              "Effect": "Allow",
              "Action": [
                  "ec2:DescribeInstances",
              ],
              "Resource": "*",
              "Condition": {
                  "StringEquals": {
                      "ec2:ResourceTag/myrole": "true"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>But when I run the "aws ec2 describe-instances --instance-id i-00169bf14adaf25e4" command, </p>
  
  <p>I got error "An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation."</p>
  
  <p>I tested full EC2 authority IAM role, and works.</p>
  
  <p>And read this <a href="https://forums.aws.amazon.com/thread.jspa?messageID=512129" rel="nofollow noreferrer">https://forums.aws.amazon.com/thread.jspa?messageID=512129</a> but it was about "Resource". </p>
  
  <p>Official document does not talk about IAM role. (<a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html</a>)</p>
  
  <p>I think I missed some "Action" part, but couldn't find it.</p>
  
  <p>Can somebody tell me Which IAM role is suitable for me? or how can I find it?</p>
  
  <p>Thanks for reading this.</p>