DevOps

EC2 IAM Policy Generator

Generate secure IAM JSON policies for Amazon EC2 instance management — start/stop, describe, reboot, and tag-based resource-level permissions.

Quick Policy Templates
#1
*

Security Notice: Wildcard Resource Detected

One or more 'Allow' statements apply across ALL resources ('*'). Consider narrowing down Resource ARNs to specific bucket or table names.

Generated IAM Policy JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEc2Access",
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*"
    }
  ]
}

EC2 IAM Policy Generator: Complete Guide

EC2 Instance Management IAM Policy

EC2 IAM policies control who can view, start, stop, and terminate instances. For operations teams, the typical pattern is to allow DescribeInstances broadly (for visibility) but restrict StartInstances and StopInstances to specific instance IDs or tagged resources.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEC2Describe",
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*"
    },
    {
      "Sid": "AllowEC2StartStop",
      "Effect": "Allow",
      "Action": [
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
    }
  ]
}

IAM Policy Generators for Other AWS Services

S3 Bucket IAM Policy GeneratorLambda IAM Policy GeneratorDynamoDB IAM Policy GeneratorAll Services →

How to Use

  1. 1

    Service Pre-Selected

    This page has pre-configured the generator for EC2. Adjust actions and Resource ARNs as needed.

  2. 2

    Select Allowed Actions

    Click the action tags to toggle specific API permissions on or off. Add custom actions if needed.

  3. 3

    Specify Resource ARNs

    Enter exact Amazon Resource Names to enforce the Principle of Least Privilege.

  4. 4

    Verify & Copy

    Check the real-time security audit badge for wildcard warnings, then copy the formatted JSON policy.

Frequently Asked Questions

What IAM permissions do I need to manage EC2 instances?+

For basic EC2 management: 'ec2:DescribeInstances' (read), 'ec2:StartInstances' and 'ec2:StopInstances' (power management), and 'ec2:RebootInstances'. Scope Resource ARNs to specific instance IDs or use tag-based conditions.

Can I restrict EC2 IAM policies to specific instances?+

Yes. Use instance-level ARNs like 'arn:aws:ec2:REGION:ACCOUNT_ID:instance/i-1234567890abcdef0' or use IAM policy Conditions with 'ec2:ResourceTag' to restrict actions to instances with specific tags.