ec2:ResourceTag/Name not working with IAM Policy

Question

Hi,

My IAM Policy is as below but not work.  I can modify security groups after removing "ec2:ResourceTag/Name".

```
aws ec2 modify-instance-attribute --instance-id  $INSTANCEID --groups $SGID --region ap-southeast-1
```

How to fix it?

```
        {
            "Sid": "AllowModifyDevOpsInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:ModifyInstanceAttribute"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/Name": [
                        "DevOps*"
                    ]
                },
                "StringEquals": {
                    "aws:RequestedRegion": "ap-southeast-1"
                }
            }
        },
```

Answer

Hello, this  IAM policy will only allow  `ec2:ModifyInstanceAttribute ` action on instances that have a tag key of `Name` and a tag value that starts with `DevOps`. It's not allowing the action on  any SGs.

To fix it, you can add the `ec2:ModifyInstanceSecurityGroups` action to your policy's "Action" array:

```
"Action": [
    "ec2:ModifyInstanceAttribute",
    "ec2:ModifyInstanceSecurityGroups"
],
```

Answer

Here is the answer after 7 months! : ) The ec2:ModifyInstanceAttribute action does not support the ec2:ResourceTag/Name condition key. This is why your policy works when you remove the ec2:ResourceTag/Name condition.

AWS does not support using resource-level permissions with EC2 tags for the ec2:ModifyInstanceAttribute action. You can only specify the * wildcard for the Resource element of such statements, meaning that the action applies to all resources.

If you want to restrict the ec2:ModifyInstanceAttribute action to specific instances, you would need to do so indirectly. For example, you could create an IAM policy that allows users to run this action only if they are also allowed to start or stop the instances. Here's an example:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowStartStopOfDevOpsInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:ModifyInstanceAttribute"
            ],
            "Resource": "arn:aws:ec2:ap-southeast-1:123456789012:instance/*",
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/Name": "DevOps*"
                }
            }
        }
    ]
}
```

In this policy, the ec2:StartInstances and ec2:StopInstances actions support the ec2:ResourceTag/Name condition key, so they are restricted to instances with a Name tag that starts with DevOps. The ec2:ModifyInstanceAttribute action is allowed for all instances, but only if the user is also allowed to start or stop the instances.

Please note that this is a workaround and might not perfectly fit your use case. It's always a good idea to test IAM policies thoroughly to ensure they provide the desired level of access.

ec2:ResourceTag/Name not working with IAM Policy

Relevant content