Amazon EC2 (ec2)

2023-02-17

10 new actions, 2 new resources | 9 updated actions, 2 updated conditions

Additions

    Actions
  • AssociateIpamResourceDiscovery
    • Description:  Grants permission to associate an IPAM resource discovery with an Amazon VPC IPAM
    • Access:  Write
    • Resources: 

      Name: ipam

      Required: Yes

      Name: ipam-resource-discovery

      Required: Yes

      Name: ipam-resource-discovery-association

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:ResourceTag/${TagKey}

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ec2:Region

    • Dependents: 

      ec2:CreateTags

  • CreateIpamResourceDiscovery
    • Description:  Grants permission to create an IPAM resource discovery
    • Access:  Write
    • Resources: 

      Name: ipam-resource-discovery

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ec2:Region

    • Dependents: 

      ec2:CreateTags

      iam:CreateServiceLinkedRole

  • DeleteIpamResourceDiscovery
    • Description:  Grants permission to delete an IPAM resource discovery
    • Access:  Write
    • Resources: 

      Name: ipam-resource-discovery

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:ResourceTag/${TagKey}

      ec2:Region

  • DescribeIpamResourceDiscoveries
    • Description:  Grants permission to describe IPAM resource discoveries
    • Access:  List
    • Conditions: 

      ec2:Region

  • DescribeIpamResourceDiscoveryAssociations
    • Description:  Grants permission to describe resource discovery associations with an Amazon VPC IPAM
    • Access:  List
    • Conditions: 

      ec2:Region

  • DisassociateIpamResourceDiscovery
    • Description:  Grants permission to disassociate a resource discovery from an Amazon VPC IPAM
    • Access:  Write
    • Resources: 

      Name: ipam-resource-discovery-association

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:ResourceTag/${TagKey}

      ec2:Region

  • GetIpamDiscoveredAccounts
    • Description:  Grants permission to retrieve IPAM discovered accounts
    • Access:  Read
    • Resources: 

      Name: ipam-resource-discovery

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:ResourceTag/${TagKey}

      ec2:Region

  • GetIpamDiscoveredResourceCidrs
    • Description:  Grants permission to retrieve the resource CIDRs that are monitored as part of a resource discovery
    • Access:  Read
    • Resources: 

      Name: ipam-resource-discovery

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:ResourceTag/${TagKey}

      ec2:Region

  • ModifyIpamResourceDiscovery
    • Description:  Grants permission to modify a resource discovery
    • Access:  Write
    • Resources: 

      Name: ipam-resource-discovery

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:ResourceTag/${TagKey}

      ec2:Region

  • PauseVolumeIO
    • Description:  Grants permission to temporarily pause I/O operations for a target Amazon EBS volume
    • Access:  Write
    • Resources: 

      Name: volume

      Required: Yes

      Name: instance

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ec2:AvailabilityZone

      ec2:Encrypted

      ec2:ParentSnapshot

      ec2:ResourceTag/${TagKey}

      ec2:VolumeID

      ec2:VolumeIops

      ec2:VolumeSize

      ec2:VolumeThroughput

      ec2:VolumeType

      ec2:EbsOptimized

      ec2:InstanceAutoRecovery

      ec2:InstanceID

      ec2:InstanceMarketType

      ec2:InstanceMetadataTags

      ec2:InstanceProfile

      ec2:InstanceType

      ec2:MetadataHttpEndpoint

      ec2:MetadataHttpPutResponseHopLimit

      ec2:MetadataHttpTokens

      ec2:RootDeviceType

      ec2:Tenancy

      ec2:Region

    Resources
  • ipam-resource-discovery-association
    • Arn:  arn:${Partition}:ec2::${Account}:ipam-resource-discovery-association/${IpamResourceDiscoveryAssociationId}
    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:ResourceTag/${TagKey}

      aws:TagKeys

      ec2:Region

      ec2:ResourceTag/${TagKey}

  • ipam-resource-discovery
    • Arn:  arn:${Partition}:ec2::${Account}:ipam-resource-discovery/${IpamResourceDiscoveryId}
    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:ResourceTag/${TagKey}

      aws:TagKeys

      ec2:Region

      ec2:ResourceTag/${TagKey}

Updates

    Actions
  • CreateLocalGatewayRoute
      Resources
    • New_value: No

      Old_value: Yes

  • DescribeStoreImageTasks
      Conditions
    • - aws:ResourceTag/${TagKey}
    • - ec2:ImageID
    • - ec2:ImageType
    • - ec2:Owner
    • - ec2:Public
    • - ec2:ResourceTag/${TagKey}
    • - ec2:RootDeviceType
      Resources
    • - image
  • DisableTransitGatewayRouteTablePropagation
      Resources
    • New_value: No

      Old_value: Yes

  • GetIpamResourceCidrs
      Resources
    • New_value: No

      Old_value: Yes

  • ModifyInstanceCapacityReservationAttributes
      Resources
    • New_value: No

      Old_value: Yes

  • ModifyVpcEndpointConnectionNotification
      Resources
    • New_value: No

      Old_value: Yes

      Conditions
    • - ec2:Attribute
    • - ec2:Attribute/${AttributeName}
  • RunScheduledInstances
      Conditions
    • - aws:ResourceTag/${TagKey}
    • - ec2:ImageID
    • - ec2:ImageType
    • - ec2:Owner
    • - ec2:Public
    • - ec2:ResourceTag/${TagKey}
    • - ec2:RootDeviceType
    • - ec2:AvailabilityZone
    • - ec2:SubnetID
    • - ec2:Vpc
    • - ec2:KeyPairName
    • - ec2:KeyPairType
    • - ec2:AssociatePublicIpAddress
    • - ec2:AuthorizedService
    • - ec2:NetworkInterfaceID
    • - ec2:Subnet
    • - ec2:PlacementGroupName
    • - ec2:PlacementGroupStrategy
    • - ec2:SecurityGroupID
    • - ec2:ParentVolume
    • - ec2:SnapshotID
    • - ec2:SnapshotTime
    • - ec2:VolumeSize
      Resources
    • - image
    • - subnet
    • - key-pair
    • - network-interface
    • - placement-group
    • - security-group
    • - snapshot
  • CreateTags
      Resources
    • + ipam-resource-discovery
    • + ipam-resource-discovery-association
  • DeleteTags
      Resources
    • + ipam-resource-discovery
    • + ipam-resource-discovery-association