Creating a policy for updating tags on EC2 instances in specific ASG

DevOps AWS
1

Is it possible to create a policy that gives a role access to update tags on ec2 instances that are part of a specific ASG? My Google skills are failing me :sob:

2 
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "autoscaling:DescribeAutoScalingGroups",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeInstances",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*",
            "Condition": {
                "StringEquals": {
                    "autoscaling:groupName": "<ASG_NAME>"
                }
            }
        }
    ]
}```
3

not tested. I don’t have any ASGs to bump this against currently

4

My most recent idea was to use the tag on the instances

5

Will look into this and see if it works, thanks for the suggestion!

6

I’m going to try out this approach looking for the aws:autoscaling:groupName tag, will report back if it works
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html|https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html

7

That way I don’t need to give any access to the autoscaling group itself

8

if that didn’t work, https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-tagging.html#tag-lifecycle there is an automatically created tag aws:autoscaling:groupName

9

Yep that’s what I ended up using!
https://og-aws.slack.com/archives/C2M3XL0QP/p1718030891154229?thread_ts=1718022586.449049&cid=C2M3XL0QP|https://og-aws.slack.com/archives/C2M3XL0QP/p1718030891154229?thread_ts=1718022586.449049&cid=C2M3XL0QP

10

Forgot to report back… Not positive I’ve fully tested it :sweat_smile: