Spot Fleet permissions

To create a policy for Spot Fleet

1. Open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Policies, Create policy.

3. On the Create policy page, choose JSON, and replace the text with the following.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:RunInstances",
                   "ec2:CreateTags",
                   "ec2:RequestSpotFleet",
                   "ec2:ModifySpotFleetRequest",
                   "ec2:CancelSpotFleetRequests",
                   "ec2:DescribeSpotFleetRequests",
                   "ec2:DescribeSpotFleetInstances",
                   "ec2:DescribeSpotFleetRequestHistory"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "iam:PassRole",
               "Resource": "arn:aws-cn:iam::*:role/aws-ec2-spot-fleet-tagging-role"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "iam:CreateServiceLinkedRole",
                   "iam:ListRoles",
                   "iam:ListInstanceProfiles"
               ],
               "Resource": "*"
           }
       ]
   }

   The preceding example policy grants a user the permissions required for most Spot Fleet use cases. To limit the user to specific API actions, specify only those API actions instead.

   Required EC2 and IAM APIs

   The following APIs must be included in the policy:

   • ec2:RunInstances – Required to launch instances in a Spot Fleet

   • ec2:CreateTags – Required to tag the Spot Fleet request, instances, or volumes

   • iam:PassRole – Required to specify the Spot Fleet role

   • iam:CreateServiceLinkedRole – Required to create the service-linked role

   • iam:ListRoles – Required to enumerate existing IAM roles

   • iam:ListInstanceProfiles – Required to enumerate existing instance profiles

   Important

   If you specify a role for the IAM instance profile in the launch specification or launch template, you must grant the user the permission to pass the role to the service. To do this, in the IAM policy include "arn:aws-cn:iam::*:role/IamInstanceProfile-role" as a resource for the iam:PassRole action. For more information, see Granting a user permissions to pass a role to an Amazon service in the IAM User Guide.

   Spot Fleet APIs

   Add the following Spot Fleet API actions to your policy, as needed:

   • ec2:RequestSpotFleet

   • ec2:ModifySpotFleetRequest

   • ec2:CancelSpotFleetRequests

   • ec2:DescribeSpotFleetRequests

   • ec2:DescribeSpotFleetInstances

   • ec2:DescribeSpotFleetRequestHistory

   Optional IAM APIs

   (Optional) To enable a user to create roles or instance profiles using the IAM console, you must add the following actions to the policy:

   • iam:AddRoleToInstanceProfile

   • iam:AttachRolePolicy

   • iam:CreateInstanceProfile

   • iam:CreateRole

   • iam:GetRole

   • iam:ListPolicies

4. Choose Review policy.

5. On the Review policy page, enter a policy name and description, and choose Create policy.

6. To provide access, add permissions to your users, groups, or roles:

   • Users managed in IAM through an identity provider:

     Create a role for identity federation. Follow the instructions in Create a role for a third-party identity provider (federation) in the IAM User Guide.

   • IAM users:

     • Create a role that your user can assume. Follow the instructions in Create a role for an IAM user in the IAM User Guide.

     • (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in Adding permissions to a user (console) in the IAM User Guide.

To create the AWSServiceRoleForEC2SpotFleet role for Spot Fleet using the console

1. Open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles.

3. Choose Create role.

4. On the Select trusted entity page, do the following:

   1. For Trusted entity type, choose Amazon service.

   2. Under Use case, for Service or use case, choose EC2.

   3. For Use case, choose EC2 - Spot Fleet.

      Note

      The EC2 - Spot Fleet use case will automatically create a policy with the required IAM permissions and will suggest AWSEC2SpotFleetServiceRolePolicy as the role name.

   4. Choose Next.

5. On the Add permissions page, choose Next.

6. On the Name, review, and create page, choose Create role.

To grant the AWSServiceRoleForEC2SpotFleet role permissions to use the CMK

• Use the create-grant command to add a grant to the CMK and to specify the principal (the AWSServiceRoleForEC2SpotFleet service-linked role) that is given permission to perform the operations that the grant permits. The CMK is specified by the key-id parameter and the ARN of the CMK. The principal is specified by the grantee-principal parameter and the ARN of the AWSServiceRoleForEC2SpotFleet service-linked role.

  aws kms create-grant \
      --region us-east-1 \
      --key-id arn:aws-cn:kms:us-east-1:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab \
      --grantee-principal arn:aws-cn:iam::111122223333:role/aws-service-role/spotfleet.amazonaws.com/AWSServiceRoleForEC2SpotFleet \
      --operations "Decrypt" "Encrypt" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "CreateGrant" "DescribeKey" "ReEncryptFrom" "ReEncryptTo"

To create the IAM role for tagging a Spot Fleet

1. Open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles.

3. Choose Create role.

4. On the Select trusted entity page, under Trusted entity type, choose Amazon service.

5. Under Use case, from Use cases for other Amazon services, choose EC2, and then choose EC2 - Spot Fleet Tagging.

6. Choose Next.

7. On the Add permissions page, choose Next.

8. On the Name, review, and create page, for Role name, enter a name for the role (for example, aws-ec2-spot-fleet-tagging-role).

9. Review the information on the page, and then choose Create role.

To add the aws:SourceArn and aws:SourceAccount condition keys to the aws-ec2-spot-fleet-tagging-role trust policy

1. Open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles.

3. Find the aws-ec2-spot-fleet-tagging-role that you created previously and choose the link (not the checkbox).

4. Under Summary, choose the Trust relationships tab, and then choose Edit trust policy.

5. In the JSON statement, add a Condition element containing your aws:SourceAccount and aws:SourceArn global condition context keys to prevent the confused deputy problem, as follows:

   "Condition": {
         "ArnLike": {
           "aws:SourceArn": "arn:aws-cn:ec2:us-east-1:account_id:spot-fleet-request/sfr-*"
         },
         "StringEquals": {
           "aws:SourceAccount": "account_id"
         }

   Note

   If the aws:SourceArn value contains the account ID and you use both global condition context keys, the aws:SourceAccount value and the account in the aws:SourceArn value must use the same account ID when used in the same policy statement.

   The final trust policy will be as follows:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Sid": "ConfusedDeputyPreventionExamplePolicy",
       "Effect": "Allow",
       "Principal": {
         "Service": "spotfleet.amazonaws.com"
       },
       "Action": "sts:AssumeRole",
       "Condition": {
         "ArnLike": {
           "aws:SourceArn": "arn:aws-cn:ec2:us-east-1:account_id:spot-fleet-request/sfr-*"
         },
         "StringEquals": {
           "aws:SourceAccount": "account_id"
         }
       }
     }
   }

6. Choose Update policy.