Did not have IAM permissions to process tags on AWS::EC2::Instance resource


Hi Everyone,

I am using Attribute Based Access Control (ABAC) to delegate permissions to Users to create CloudFormation and EC2 instances from CF template.

I am getting 'Did not have IAM permissions to process tags on AWS::EC2::Instance resource.' and 'API: ec2:RunInstances You are not authorized to perform this operation. Encoded authorization failure message' errors while trying to create CF Stack. All corresponding 'access-team' and 'access-project' tags are provided in the CloudFormation Template. The CF Template and corresponding ABAC IAM Policy are attached.

However, I am able to create exact EC2 Instance manually without any issue via AWS EC2 Console case I am supplying corresponding 'access-team' and 'access-project' Tags during EC2 Instance creation.

Could someone help me to narrow down the root of that issue and what exactly I should change in IAM Policy to deploy CF Stack ?


Edited by: innos on Feb 19, 2021 6:19 AM

Edited by: innos on Feb 24, 2021 7:56 AM

asked 2 years ago942 views
1 Answer

Hi Guys,

My request has been resolved by AWS Support with following issue description :

From the public docs, "When you create an EC2 instance with AWS CloudFormation using the resource AWS::EC2::Instance, AWS CloudFormation makes two API calls: RunInstances and CreateTags. RunInstances creates the instance and CreateTags applies the necessary tags after the instance is created. The RunInstances request made by AWS CloudFormation doesn't support the tags, but the API does support the tags." Please refer to [1] for more information on the same.

So, the workaround for this issue is using "AWS::EC2::LaunchTemplate" resource for EC2 Instance and specify the required Tags on the Volume using "TagSpecification" property in "AWS::EC2::LaunchTemplate" resource. Please refer [2][3] for more information.

We can specify the required Tags for the resources as below.

    Type: 'AWS::EC2::Instance'  
        LaunchTemplateId: !Ref RequiredTagsLaunchTemplate  
        Version: 1  
      InstanceType: r4.xlarge  
    Type: 'AWS::EC2::LaunchTemplate'  
          - ResourceType: Volume  
              - Key: Env  
                Value: Dev  

[1] https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-ec2-iam-runinstances/
[2] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-launchtemplate.html
[3] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-tagspecification.html

I hope this information will be useful for somebody.


answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions