How can I allow an IAM user to see a Lightsail instance created via root account?

Question

Your account can not create an instance using this Lightsail plan size. Please try a smaller plan size or contact Customer Support
if you need to use a larger plan. - An attempt to create the $12 90 day trial lightsail instance, with an IAM user.

I created the lower plan, to run testing with Plesk before purchasing, however, I quickly ran into the issue of Plesk consistently freezing, due to ram limitations.

I switched over to root, to see if I could adjust and saw the option to create the $12 instance and decided to do so, to give my IAM user access. The instance was created, but could not be found by the IAM user with AdministratorAccess permissions, even though they are in the same region - Virginia Zone A.

Upon creating this 2nd 90 day trial via root, I received an email from AWS, for cost anomaly detection. I want to avoid charge issues, before being able to properly test lightsail with Plesk by removing the $7 plan, created by the IAM user, but keeping the $12 plan created on root, while allowing the IAM user to actually see the instance.

Root cannot see the $7 instance created by IAM user.
IAM user cannot see the $12 instance created by root.

SburvT · Answer

Yeah, Lightsail is a bit of a black box when it comes to IAM permissions, much more limited compared to full EC2. Even if your IAM user has AdministratorAccess, Lightsail still doesn’t support resource-level permissions the way you'd expect.

Basically, Lightsail resources (like instances) are isolated per user, even within the same AWS account. So if the root user creates an instance, IAM users won’t see it by default, and vice versa. It's not a region issue, it's just how Lightsail handles scoping.

A few things you can try:
Switch to full EC2 if you need proper shared access and fine-grained IAM control. Yes, it's more complex, but worth it for team workflows. If you must stick with Lightsail, you’ll need to use root for managing shared instances. IAM users are practically second-class citizens here.

You can script interactions via the AWS CLI using the root credentials (with proper caution) if the goal is just to enable some automation or visibility.

I'd recommend deleting the unused instance ASAP to avoid extra charges, trial or not.

How can I allow an IAM user to see a Lightsail instance created via root account?

Add your answer

Relevant content