EC2FastLaunchFullAccess

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

This policy grants full access to EC2 Fast Launch actions

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/EC2FastLaunchFullAccess
Default version: v5
Created: 2024-05-13
Last edited: 2026-08-04
Services: cloudformation, ec2, iam

Control-plane actions (42)

By access level: 15 List, 3 Read, 2 Tagging, 22 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudFormation	10 of 104	1 List, 3 Read, 1 Tagging, 5 Write; 10 restricted, 10 conditional	cloudformation:CreateStack, cloudformation:DeleteStack, cloudformation:DescribeStackEvents, cloudformation:DescribeStackResource, cloudformation:DescribeStackResources, cloudformation:DescribeStacks, cloudformation:RollbackStack, cloudformation:TagResource, cloudformation:UpdateStack, cloudformation:UpdateTerminationProtection
EC2	30 of 834	14 List, 1 Tagging, 15 Write; 14 restricted, 13 conditional	ec2:AuthorizeSecurityGroupEgress, ec2:CreateLaunchTemplate, ec2:CreateLaunchTemplateVersion, ec2:CreateSecurityGroup, ec2:CreateSubnet, ec2:CreateTags, ec2:CreateVpc, ec2:DeleteSecurityGroup, ec2:DeleteSubnet, ec2:DeleteVpc, ec2:DescribeAccountAttributes, ec2:DescribeAvailabilityZones and 18 more
IAM	2 of 190	2 Write; 2 restricted, 2 conditional	iam:CreateServiceLinkedRole, iam:PassRole

CloudFormation: 10 actions

cloudformation:CreateStack (Write)
cloudformation:DeleteStack (Write)
cloudformation:DescribeStackEvents (Read)
cloudformation:DescribeStackResource (Read)
cloudformation:DescribeStackResources (Read)
cloudformation:DescribeStacks (List)
cloudformation:RollbackStack (Write)
cloudformation:TagResource (Tagging)
cloudformation:UpdateStack (Write)
cloudformation:UpdateTerminationProtection (Write)

EC2: 30 actions

ec2:AuthorizeSecurityGroupEgress (Write)
ec2:CreateLaunchTemplate (Write)
ec2:CreateLaunchTemplateVersion (Write)
ec2:CreateSecurityGroup (Write)
ec2:CreateSubnet (Write)
ec2:CreateTags (Tagging)
ec2:CreateVpc (Write)
ec2:DeleteSecurityGroup (Write)
ec2:DeleteSubnet (Write)
ec2:DeleteVpc (Write)
ec2:DescribeAccountAttributes (List)
ec2:DescribeAvailabilityZones (List)
ec2:DescribeFastLaunchImages (List)
ec2:DescribeImages (List)
ec2:DescribeInstances (List)
ec2:DescribeLaunchTemplateVersions (List)
ec2:DescribeLaunchTemplates (List)
ec2:DescribeRegions (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeSnapshots (List)
ec2:DescribeSubnets (List)
ec2:DescribeTags (List)
ec2:DescribeVolumes (List)
ec2:DescribeVpcs (List)
ec2:DisableFastLaunch (Write)
ec2:EnableFastLaunch (Write)
ec2:ModifyLaunchTemplate (Write)
ec2:ModifyVpcAttribute (Write)
ec2:RevokeSecurityGroupEgress (Write)
ec2:RunInstances (Write)

IAM: 2 actions

iam:CreateServiceLinkedRole (Write)
iam:PassRole (Write)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 24 write, tagging or permissions-management actions, short of full control of any service.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EC2FastLaunch",
      "Effect": "Allow",
      "Action": [
        "ec2:EnableFastLaunch",
        "ec2:DisableFastLaunch",
        "ec2:DescribeFastLaunchImages"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2ReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeImages",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:DescribeSnapshots",
        "ec2:DescribeVolumes",
        "ec2:DescribeRegions",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:DescribeInstances",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeTags",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeAccountAttributes"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2CreateVPC",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpc"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2ModifyDeleteVPC",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteVpc",
        "ec2:CreateSubnet",
        "ec2:ModifyVpcAttribute",
        "ec2:CreateSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2CreateSubnet",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSubnet"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2DeleteSubnet",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteSubnet"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2CreateSecurityGroup",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2ManageSecurityGroupEgress",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupEgress"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2DeleteSecurityGroup",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CloudFormation",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:CreateStack",
        "cloudformation:UpdateStack",
        "cloudformation:RollbackStack",
        "cloudformation:DeleteStack",
        "cloudformation:UpdateTerminationProtection",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResource",
        "cloudformation:DescribeStackResources"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/EC2FastLaunch*/*"
      ],
      "Condition": {
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CloudFormationTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "cloudformation:TagResource"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/EC2FastLaunch*/*"
      ],
      "Condition": {
        "StringEquals": {
          "cloudformation:CreateAction": "CreateStack"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2LaunchTemplateModify",
      "Effect": "Allow",
      "Action": [
        "ec2:ModifyLaunchTemplate",
        "ec2:CreateLaunchTemplate",
        "ec2:CreateLaunchTemplateVersion"
      ],
      "Resource": "arn:aws:ec2:*:*:launch-template/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "EC2LaunchInstance",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*::image/*",
        "arn:aws:ec2:*:*:key-pair/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:launch-template/*",
        "arn:aws:license-manager:*:*:license-configuration:*"
      ]
    },
    {
      "Sid": "EC2LaunchInstanceWithVolAndInstance",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*:*:instance/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "EC2 Fast Launch"
        }
      }
    },
    {
      "Sid": "EC2Tags",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": [
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:snapshot/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": "RunInstances"
        }
      }
    },
    {
      "Sid": "EC2ManageTags",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:launch-template/*",
        "arn:aws:ec2:*:*:vpc/*",
        "arn:aws:ec2:*:*:subnet/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "EC2 Fast Launch"
        },
        "ForAnyValue:StringLike": {
          "aws:CalledVia": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IAMSLR",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fastlaunch.amazonaws.com/AWSServiceRoleForEC2FastLaunch",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "ec2fastlaunch.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IAMSLRPassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:instance-profile/*",
        "arn:aws:iam::*:role/*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "ec2.amazonaws.com",
            "ec2.amazonaws.com.cn"
          ]
        }
      }
    }
  ]
}

Version history

Current version v5, edited by AWS on 2026-08-04. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/EC2FastLaunchFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/EC2FastLaunchFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/EC2FastLaunchFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/EC2FastLaunchFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "ec2fastlaunchfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/EC2FastLaunchFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("EC2FastLaunchFullAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.