Working with AWS IAM Policy

• Policy Document can’t exceed 6144 char long.
• One IAM Role at most can be bound to 10 IAM policies.
• ec2:CreateLaunchTemplate as a condition key can only be used in ec2:RunInstances, ec2:CreateFleet, ec2:RequestSpotFleet and:
  • In the request body of the three APIs above, the launch template must be referred via launch template name.
  • E.g. if ec2:RunInstances is called with a launch template referred with ARN/launch template ID, using ec2:CreateLaunchTemplateName as a condition key won’t let the policy pass.
• When we sync ASGs, we are effectively calling (some calls were made in AWS, not really explicitly called from our code):
  • CreateLaunchTemplate → ModifyLaunchTemplate → CreateLaunchTemplateVersion → CreateTags → CreateOrUpdateTags → RunInstances → UpdateAutoScalingGroup
• When we launch a host in the ASG, we call (some calls were made in AWS, not really explicitly called from our code):
  • CreateLaunchTemplate → RunInstances → CreateGrant x3 (not sure why there is a CreateLaunchTemplate call.)

---

Related:

• qa-fleetmanager-iam-policy-fix-too-much-priviledge