Creating a policy for updating tags on EC2 instances in specific ASG

Is it possible to create a policy that gives a role access to update tags on ec2 instances that are part of a specific ASG? My Google skills are failing me :sob:

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "autoscaling:DescribeAutoScalingGroups",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeInstances",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*",
            "Condition": {
                "StringEquals": {
                    "autoscaling:groupName": "<ASG_NAME>"
                }
            }
        }
    ]
}```

not tested. I don’t have any ASGs to bump this against currently

My most recent idea was to use the tag on the instances

Will look into this and see if it works, thanks for the suggestion!

I’m going to try out this approach looking for the aws:autoscaling:groupName tag, will report back if it works
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html|https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html

That way I don’t need to give any access to the autoscaling group itself

if that didn’t work, https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-tagging.html#tag-lifecycle there is an automatically created tag aws:autoscaling:groupName

Yep that’s what I ended up using!
https://og-aws.slack.com/archives/C2M3XL0QP/p1718030891154229?thread_ts=1718022586.449049&cid=C2M3XL0QP|https://og-aws.slack.com/archives/C2M3XL0QP/p1718030891154229?thread_ts=1718022586.449049&cid=C2M3XL0QP

Forgot to report back… Not positive I’ve fully tested it :sweat_smile: