Using AWS Identity and Access Management

Amazon EC2 has its own permissions system that covers Amazon Machine Images (AMIs) and Amazon EBS snapshots. There's no ACL system or policy system to give permissions to launch AMIs or create volumes from snapshots. Instead, the Amazon EC2 API lets you modify the attributes on an AMI or snapshot to give another AWS Account those permissions. The following diagram illustrates the concept. Each AMI has a LaunchPermission attribute that you can set to one or more AWS Account IDs in order to share the AMI with those AWS Accounts. Each Amazon EBS snapshot has a similar VolumePermission attribute.

This sharing works at the AWS Account level only; you can't restrict access only to specific users within the AWS Account you're sharing, or only to specific users in your own AWS Account. All users in the AWS Account you're sharing with can use the AMI or snapshot you've shared.

	Note
	Don't be confused by the fact that the attribute for specifying the AWS Account to share with is called UserId. The value you specify for UserId is an AWS Account ID.

For information on modifying attributes on an AMI, see Sharing AMIs. For information on modifying attributes on a snapshot, see Modifying Snapshot Permissions

Using IAM with Amazon EC2 doesn't change how you use the Amazon EC2 API to share AMIs and snapshots with other AWS Accounts. However, you can use IAM policies to specify which Amazon EC2 actions a user in your AWS Account can use with EC2 resources in general. You can't specify a particular Amazon EC2 resource in the policy (e.g,. a specific AMI). Instead, you must specify * as the resource to indicate all resources in the AWS Account.

Example 1: Creating a permission policy

You could create a policy that gives the Developers group permission to use only RunInstances, StopInstances, StartInstances, TerminateInstances, and DescribeInstances. They could then use those with any AMI that belongs to your AWS Account, any public AMIs, or any AMIs that have been shared with your AWS Account. The following diagram illustrates the concept.

	Important
	Amazon EC2 uses SSH keys, Windows passwords, and security groups to control who has access to specific Amazon EC2 instances. You can't use the IAM system to allow or deny access to a specific instance.

Example 2: Setting LaunchPermission

This example builds on the previous one. In addition to the IAM policy attached to the Developers group, you set the LaunchPermission attribute on the AMI in your AWS Account with ID ami-12345678 so that two other AWS Accounts can launch the AMI. Anyone possessing the keys for either of those AWS Accounts can launch an instance of the AMI. Also, any user in the Developers group can launch an instance of that AMI, because the Developers group has permission to use RunInstances with any AMI in the AWS Account.

For examples of IAM policies that cover Amazon EC2 actions, see Example Policies for Amazon EC2. For more information about granting permissions to AMIs and snapshots, refer to the topics about the ModifyImageAttribute and ModifySnapshotAttribute APIs in the Amazon Elastic Compute Cloud API Reference.

Amazon EC2 has no Amazon Resource Names (ARNs) because you can t specify a particular Amazon EC2 resource in an IAM policy. When writing a policy to control access to Amazon EC2 actions, you use * as the resource. For more information about ARNs, see Identifiers For IAM Entities.

In an IAM policy, you can specify any and all actions that Amazon EC2 offers. Each action name must be prefixed with the lowercase string ec2:. For example: ec2:RunInstances, ec2:CreateImage, ec2:* (for all Amazon EC2 actions). For a list of the actions, refer to the Query API or SOAP API action names in the Amazon Elastic Compute Cloud API Reference.

Amazon EC2 implements the following policy keys:

If you use aws:SourceIp, and the request comes from an Amazon EC2 instance, we evaluate the instance's public IP address to determine if access is allowed.

For services that use only SSL, such as Amazon RDS and Amazon Route 53, the aws:SecureTransport key has no meaning.

The key names are case insensitive. For example, aws:CurrentTime is equivalent to AWS:currenttime.

This section shows several simple policies for controlling user access to Amazon EC2.

	Note
	In the future, Amazon EC2 might add new actions that should logically be included in one of the following policies, based on the policy’s stated goals.

{
   "Statement":[{
      "Effect":"Allow",
      "Action":["ec2:DescribeInstances","ec2:RunInstances",
                "ec2:StopInstances","ec2:StartInstances",
                "ec2:TerminateInstances"],
      "Resource":"*"
      }
   ]
}

{
   "Statement":[{
      "Effect":"Allow",
      "Action":"ec2:Describe*",
      "Resource":"*"
      }
   ]
}