AmazonECSInfrastructureRolePolicyForManagedInstances
Description: Provides ECS access to create and manage EC2 managed resources
AmazonECSInfrastructureRolePolicyForManagedInstances is an AWS managed policy.
Using this policy
You can attach AmazonECSInfrastructureRolePolicyForManagedInstances to your users, groups, and roles.
Policy details
-
Type: AWS managed policy
-
Creation time: September 26, 2025, 18:04 UTC
-
Edited time: September 29, 2025, 21:04 UTC
-
ARN:
arn:aws:iam::aws:policy/AmazonECSInfrastructureRolePolicyForManagedInstances
Policy version
Policy version: v2 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "CreateLaunchTemplateForManagedInstances", "Effect" : "Allow", "Action" : [ "ec2:CreateLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:launch-template/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/AmazonECSManaged" : "true" } } }, { "Sid" : "CreateLaunchTemplateVersionsForManagedInstances", "Effect" : "Allow", "Action" : [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:launch-template/*" ], "Condition" : { "StringEquals" : { "ec2:ManagedResourceOperator" : "ecs.amazonaws.com" } } }, { "Sid" : "ProvisionEC2InstancesForManagedInstances", "Effect" : "Allow", "Action" : [ "ec2:CreateFleet" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:image/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/AmazonECSManaged" : "true" } } }, { "Sid" : "RunInstancesForManagedInstances", "Effect" : "Allow", "Action" : [ "ec2:RunInstances" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/AmazonECSManaged" : "true" } } }, { "Sid" : "RunInstancesForECSManagedLaunchTemplates", "Effect" : "Allow", "Action" : [ "ec2:RunInstances" ], "Resource" : [ "arn:aws:ec2:*:*:launch-template/*" ], "Condition" : { "StringEquals" : { "ec2:ResourceTag/AmazonECSManaged" : "true" } } }, { "Sid" : "RunInstancesForSupportingResources", "Effect" : "Allow", "Action" : [ "ec2:RunInstances" ], "Resource" : [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*::image/*" ] }, { "Sid" : "TagOnCreateEC2ResourcesForManagedInstances", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition" : { "StringEquals" : { "ec2:CreateAction" : [ "CreateFleet", "CreateLaunchTemplate", "RunInstances" ] } } }, { "Sid" : "PassInstanceRoleForManagedInstances", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/ecsInstanceRole*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : "ec2.amazonaws.com" } } }, { "Sid" : "CreateServiceLinkedRoleForEC2Spot", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot" ] }, { "Sid" : "DescribeEC2ResourcesManagedByECS", "Effect" : "Allow", "Action" : [ "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeNetworkInterfaces", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeAvailabilityZones", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource" : "*" } ] }
Learn more
