What are the minimum permission needed to start an EC2 instance

Question

What are the least privileged needed to start an EC2 instance:
Can get to work with ec2:*

but when try to limit the policy with the following  the creation fails:

```
        - Sid: EC2GuardRail
                Effect: Allow
                Action:
                   - 'ec2:RunInstance'
                   - 'iam:PassRole'
                   - 'ec2:DescribeSubnets'
                   - 'ec2:DescribeSecurityGroups'
                   - 'ec2:DescribeInstances'
                   - 'ec2:DescribeInstancesTypes'
                   - 'ec2:CreateTags'
                   - 'ec2:DescribeImages'
                   - 'ec2:DescribeKeyPairs'
                   - 'ec2:DescribeVpcs'
                   - 'ec2:CreateSecurityGroup'
                   - 'ec2:AuthorizeSecurityGroupIngress'
                   - 'ec2:CreateKeyPair'
                   - 'ec2:RunInstance'
                   - 'ec2:TerminateInstance'
                Resource:
                 - '*'
```

Answer

Hello,

To start an EC2 instance, the only Action I see that you're missing is `ec2:StartInstances`.

In regards to minimum permissions for starting an instance, I would recommend allowing:
```
ec2:StartInstances
ec2:DescribeInstances
```

You may also want to grant `ec2:StopInstances` if you want to allow a user to also stop the instance.

You could also limit the scope to only the user who created the instance or instances that match a specific tag.  See here for additional documentation on that:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_ec2_tag-owner.html

What are the minimum permission needed to start an EC2 instance

Relevant questions

EC2 instance failure, wont start

IAM role needed to assign a security group to a running EC2 instance

Connect to the database in an EC2 instance from the ECS cluster

If we provision an EC2 windows Instance, will it includes the windows license by default? what are the licensing types available from AWS

AWS cloudshell fails to start！Unable to start the environment. To retry, refresh the browser or restart by selecting Actions, Restart AWS CloudShell.

What is the minimum interaction per item needed for Amazon Personalize SIMS recipe?

What is the most effective way to automate the EC2 instance run Python script with a specific argument value?

what credentials are needed for using only role when reading logs from aws cloudwatch