EC2 Image Builder Integration Fails with "ec2:CreateVpc" Permission Error for Windows Server 2022 Core AMI

This error occurs because EC2 Image Builder is attempting to enable EC2 Fast Launch for your Windows Server 2022 Core AMI, but the service role being used (AWSServiceRoleForImageBuilder) lacks the necessary permissions to create VPC resources required for this feature.

To resolve this issue, you need to update the IAM permissions for the service role that EC2 Image Builder is using. Specifically, you need to add the ec2:CreateVpc permission to the role's policy.

Here's how to fix it:

1. Navigate to the IAM console
2. Find the role mentioned in the error message (AWSServiceRoleForImageBuilder)
3. Update the policy by adding a new statement that grants the ec2:CreateVpc permission on the required resource
4. Save the changes and attempt the integration again

Alternatively, if you don't have permissions to update this service role (as it's an AWS-managed role), you may need to:

• Escalate to someone with appropriate permissions to make these changes
• Check if there are any Service Control Policies (SCPs) in your AWS Organization that might be restricting these actions
• Consider attaching the EC2FastLaunchFullAccess policy as mentioned in the error message

Once the appropriate permissions are in place, the EC2 Image Builder should be able to complete the integration step successfully, enabling EC2 Fast Launch for your Windows Server 2022 Core AMI.
Sources
How do I troubleshoot when User: arn is no authorized to perform Create * or Delete * or Update * on resource(s) because no identity- policy allows the actions | AWS re:Post
Welcome - EC2 Image Builder
Amazon EC2 Image Builder Features - AWS