Skip to main content
IAM Policy Map

AmazonEC2FullAccess

AdminAWS managedActiveReviewedShow on mapCompare

Summary

Provides full access to Amazon EC2 via the AWS Management Console. The policy allows ec2:*, elasticloadbalancing:*, cloudwatch:* and autoscaling:* on all resources, and iam:CreateServiceLinkedRole for a fixed list of services.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/AmazonEC2FullAccess
Default version
v5
Created
Last edited
Services
autoscaling, cloudwatch, ec2, elasticloadbalancing, iam

Control-plane actions (1140)

By access level: 273 List, 32 Permissions management, 132 Read, 8 Tagging, 695 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
EC2 Auto ScalingAll 68 actions (see the EC2 Auto Scaling page)22 List, 1 Read, 2 Tagging, 43 Write; 0 restricted, 0 conditionalautoscaling:*
CloudWatchAll 160 actions (see the CloudWatch page)24 List, 8 Permissions management, 46 Read, 2 Tagging, 80 Write; 0 restricted, 0 conditionalcloudwatch:*
EC2All 834 actions (see the EC2 page)225 List, 23 Permissions management, 63 Read, 2 Tagging, 521 Write; 0 restricted, 0 conditionalec2:*
ELBAll 77 actions (see the ELB page)2 List, 1 Permissions management, 22 Read, 2 Tagging, 50 Write; 0 restricted, 0 conditionalelasticloadbalancing:*
IAM1 of 1901 Write; 1 restricted, 1 conditionaliam:CreateServiceLinkedRole
IAM: 1 actions
  • iam:CreateServiceLinkedRole (Write)

Data-plane actions (5)

By access level: 1 List, 3 Read, 1 Write.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
CloudWatchAll 5 actions (see the CloudWatch page)1 List, 3 Read, 1 Write; 0 restricted, 0 conditionalcloudwatch:*

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants at least 80% of the write and permissions-management actions of: autoscaling (43 of 43), cloudwatch (89 of 89), ec2 (544 of 544), elasticloadbalancing (51 of 51).

Guidance

Practical scope

Four statements allow every action in the ec2, elasticloadbalancing, cloudwatch and autoscaling namespaces on Resource "*". A fifth allows iam:CreateServiceLinkedRole on all resources, with a StringEquals condition on iam:AWSServiceName limited to autoscaling.amazonaws.com, ec2scheduled.amazonaws.com, elasticloadbalancing.amazonaws.com, spot.amazonaws.com, spotfleet.amazonaws.com and transitgateway.amazonaws.com.

Use cases

  • Give users, groups or roles full access to Amazon EC2, including the Elastic Load Balancing, CloudWatch and Auto Scaling actions the policy includes.

Best practices

  • AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.

Security considerations

  • The wildcards ec2:*, elasticloadbalancing:*, cloudwatch:* and autoscaling:* on Resource "*" allow every action in those services on all resources, not only reads.
  • You can't change the permissions in AWS managed policies. Services occasionally add permissions to an AWS managed policy to support new features, and this type of update affects all identities where the policy is attached.

Assignment guidance

You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon EC2 is intended. For narrower access, the IAM User Guide suggests writing a customer managed policy with only the permissions your team needs.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach AmazonEC2FullAccess?
The Amazon EC2 User Guide says you can attach it to your IAM identities and that it grants permissions that allow full access to Amazon EC2. Attach it where that is the intended scope. For narrower access, write a customer managed policy with only the permissions your team needs.
What does AmazonEC2FullAccess grant?
It allows ec2:*, elasticloadbalancing:*, cloudwatch:* and autoscaling:* on all resources. It also allows iam:CreateServiceLinkedRole, limited by an iam:AWSServiceName condition to autoscaling.amazonaws.com, ec2scheduled.amazonaws.com, elasticloadbalancing.amazonaws.com, spot.amazonaws.com, spotfleet.amazonaws.com and transitgateway.amazonaws.com.
What are the security risks of AmazonEC2FullAccess?
It allows every action in the EC2, Elastic Load Balancing, CloudWatch and Auto Scaling namespaces on all resources, not only reads. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. Services add permissions to AWS managed policies over time, and each update affects all identities the policy is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "ec2:*",
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "elasticloadbalancing:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cloudwatch:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "autoscaling:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": [
            "autoscaling.amazonaws.com",
            "ec2scheduled.amazonaws.com",
            "elasticloadbalancing.amazonaws.com",
            "spot.amazonaws.com",
            "spotfleet.amazonaws.com",
            "transitgateway.amazonaws.com"
          ]
        }
      }
    }
  ]
}

Version history

Current version v5, edited by AWS on 2018-11-27. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazonec2fullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonEC2FullAccess"),
);

Sources