Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon EC2 Auto Scaling

Amazon EC2 Auto Scaling (service prefix: autoscaling) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon EC2 Auto Scaling
Actions defined by Amazon EC2 Auto Scaling
Resource types defined by Amazon EC2 Auto Scaling
Condition keys for Amazon EC2 Auto Scaling

API operations defined by Amazon EC2 Auto Scaling

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AttachInstances	autoscaling:AttachInstances			Write
AttachLoadBalancerTargetGroups	autoscaling:AttachLoadBalancerTargetGroups			Write
AttachLoadBalancers	autoscaling:AttachLoadBalancers			Write
AttachTrafficSources	autoscaling:AttachTrafficSources			Write
BatchDeleteScheduledAction	autoscaling:BatchDeleteScheduledAction			Write
BatchPutScheduledUpdateGroupAction	autoscaling:BatchPutScheduledUpdateGroupAction			Write
CancelInstanceRefresh	autoscaling:CancelInstanceRefresh			Write
CompleteLifecycleAction	autoscaling:CompleteLifecycleAction			Write
CreateAutoScalingGroup	autoscaling:CreateAutoScalingGroup			Write
	autoscaling:CreateOrUpdateTags			Tagging, Write
	iam:PassRole	iam:PassedToService	autoscaling.amazonaws.com, ec2.amazonaws.com	Write
CreateLaunchConfiguration	autoscaling:CreateLaunchConfiguration			Write
CreateLaunchConfiguration	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
CreateOrUpdateTags	autoscaling:CreateOrUpdateTags			Tagging, Write
DeleteAutoScalingGroup	autoscaling:DeleteAutoScalingGroup			Write
DeleteLaunchConfiguration	autoscaling:DeleteLaunchConfiguration			Write
DeleteLifecycleHook	autoscaling:DeleteLifecycleHook			Write
DeleteNotificationConfiguration	autoscaling:DeleteNotificationConfiguration			Write
DeletePolicy	autoscaling:DeletePolicy			Write
DeleteScheduledAction	autoscaling:DeleteScheduledAction			Write
DeleteTags	autoscaling:DeleteTags			Tagging, Write
DeleteWarmPool	autoscaling:DeleteWarmPool			Write
DescribeAccountLimits	autoscaling:DescribeAccountLimits			List
DescribeAdjustmentTypes	autoscaling:DescribeAdjustmentTypes			List
DescribeAutoScalingGroups	autoscaling:DescribeAutoScalingGroups			List
DescribeAutoScalingInstances	autoscaling:DescribeAutoScalingInstances			List
DescribeAutoScalingNotificationTypes	autoscaling:DescribeAutoScalingNotificationTypes			List
DescribeInstanceRefreshes	autoscaling:DescribeInstanceRefreshes			List
DescribeLaunchConfigurations	autoscaling:DescribeLaunchConfigurations			List
DescribeLifecycleHookTypes	autoscaling:DescribeLifecycleHookTypes			List
DescribeLifecycleHooks	autoscaling:DescribeLifecycleHooks			List
DescribeLoadBalancerTargetGroups	autoscaling:DescribeLoadBalancerTargetGroups			List
DescribeLoadBalancers	autoscaling:DescribeLoadBalancers			List
DescribeMetricCollectionTypes	autoscaling:DescribeMetricCollectionTypes			List
DescribeNotificationConfigurations	autoscaling:DescribeNotificationConfigurations			List
DescribePolicies	autoscaling:DescribePolicies			List
DescribeScalingActivities	autoscaling:DescribeScalingActivities			List
DescribeScalingProcessTypes	autoscaling:DescribeScalingProcessTypes			List
DescribeScheduledActions	autoscaling:DescribeScheduledActions			List
DescribeTags	autoscaling:DescribeTags			Read
DescribeTerminationPolicyTypes	autoscaling:DescribeTerminationPolicyTypes			List
DescribeTrafficSources	autoscaling:DescribeTrafficSources			List
DescribeWarmPool	autoscaling:DescribeWarmPool			List
DetachInstances	autoscaling:DetachInstances			Write
DetachLoadBalancerTargetGroups	autoscaling:DetachLoadBalancerTargetGroups			Write
DetachLoadBalancers	autoscaling:DetachLoadBalancers			Write
DetachTrafficSources	autoscaling:DetachTrafficSources			Write
DisableMetricsCollection	autoscaling:DisableMetricsCollection			Write
EnableMetricsCollection	autoscaling:EnableMetricsCollection			Write
EnterStandby	autoscaling:EnterStandby			Write
ExecutePolicy	autoscaling:ExecutePolicy			Write
ExitStandby	autoscaling:ExitStandby			Write
GetPredictiveScalingForecast	autoscaling:GetPredictiveScalingForecast			List
LaunchInstances	autoscaling:LaunchInstances			Write
PutLifecycleHook	autoscaling:PutLifecycleHook			Write
PutLifecycleHook	iam:PassRole	iam:PassedToService	autoscaling.amazonaws.com	Write
PutNotificationConfiguration	autoscaling:PutNotificationConfiguration			Write
PutScalingPolicy	autoscaling:PutScalingPolicy			Write
PutScheduledUpdateGroupAction	autoscaling:PutScheduledUpdateGroupAction			Write
PutWarmPool	autoscaling:PutWarmPool			Write
RecordLifecycleActionHeartbeat	autoscaling:RecordLifecycleActionHeartbeat			Write
ResumeProcesses	autoscaling:ResumeProcesses			Write
RollbackInstanceRefresh	autoscaling:RollbackInstanceRefresh			Write
SetDesiredCapacity	autoscaling:SetDesiredCapacity			Write
SetInstanceHealth	autoscaling:SetInstanceHealth			Write
SetInstanceProtection	autoscaling:SetInstanceProtection			Write
StartInstanceRefresh	autoscaling:StartInstanceRefresh			Write
SuspendProcesses	autoscaling:SuspendProcesses			Write
TerminateInstanceInAutoScalingGroup	autoscaling:TerminateInstanceInAutoScalingGroup			Write
UpdateAutoScalingGroup	autoscaling:UpdateAutoScalingGroup			Write
UpdateAutoScalingGroup	iam:PassRole	iam:PassedToService	autoscaling.amazonaws.com	Write

Actions defined by Amazon EC2 Auto Scaling

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AttachInstances	Grants permission to attach one or more EC2 instances to the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
AttachLoadBalancerTargetGroups	Grants permission to attach one or more target groups to the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} autoscaling:TargetGroupARNs aws:ResourceTag/${TagKey}	Write
AttachLoadBalancers	Grants permission to attach one or more load balancers to the specified Auto Scaling group	autoScalingGroup*	autoscaling:LoadBalancerNames autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
AttachTrafficSources	Grants permission to attach one or more traffic sources to an Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} autoscaling:TrafficSourceIdentifiers aws:ResourceTag/${TagKey}	Write
BatchDeleteScheduledAction	Grants permission to delete the specified scheduled actions	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
BatchPutScheduledUpdateGroupAction	Grants permission to create or update multiple scheduled scaling actions for an Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
CancelInstanceRefresh	Grants permission to cancel an instance refresh operation in progress	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
CompleteLifecycleAction	Grants permission to complete the lifecycle action for the specified token or instance with the specified result	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
CreateAutoScalingGroup	Grants permission to create an Auto Scaling group with the specified name and attributes	autoScalingGroup*	autoscaling:CapacityReservationIds autoscaling:CapacityReservationResourceGroupArns autoscaling:ImageId autoscaling:InstanceTypes autoscaling:LaunchConfigurationName autoscaling:LaunchTemplateVersionSpecified autoscaling:LoadBalancerNames autoscaling:MaxSize autoscaling:MinSize autoscaling:ResourceTag/${TagKey} autoscaling:TargetGroupARNs autoscaling:TrafficSourceIdentifiers autoscaling:VPCZoneIdentifiers aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLaunchConfiguration	Grants permission to create a launch configuration	launchConfiguration*	autoscaling:ImageId autoscaling:InstanceType autoscaling:MetadataHttpEndpoint autoscaling:MetadataHttpPutResponseHopLimit autoscaling:MetadataHttpTokens autoscaling:SpotPrice	Write
CreateOrUpdateTags	Grants permission to create or update tags for the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
DeleteAutoScalingGroup	Grants permission to delete the specified Auto Scaling group	autoScalingGroup*	autoscaling:ForceDelete autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DeleteLaunchConfiguration	Grants permission to delete the specified launch configuration	launchConfiguration*		Write
DeleteLifecycleHook	Grants permission to deletes the specified lifecycle hook	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DeleteNotificationConfiguration	Grants permission to delete the specified notification	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DeletePolicy	Grants permission to delete the specified Auto Scaling policy	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DeleteScheduledAction	Grants permission to delete the specified scheduled action	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DeleteTags	Grants permission to delete the specified tags	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
DeleteWarmPool	Grants permission to delete the warm pool associated with the Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DescribeAccountLimits	Grants permission to describe the current Auto Scaling resource limits for your Amazon Web Services account			List
DescribeAccountSettings	Grants permission to describe the current Amazon EC2 Auto Scaling account settings for your account			List
DescribeAdjustmentTypes	Grants permission to describe the policy adjustment types for use with PutScalingPolicy			List
DescribeAutoScalingGroups	Grants permission to describe one or more Auto Scaling groups. If a list of names is not provided, the call describes all Auto Scaling groups			List
DescribeAutoScalingInstances	Grants permission to describe one or more Auto Scaling instances. If a list is not provided, the call describes all instances			List
DescribeAutoScalingNotificationTypes	Grants permission to describe the notification types that are supported by Auto Scaling			List
DescribeInstanceRefreshes	Grants permission to describe one or more instance refreshes for an Auto Scaling group			List
DescribeLaunchConfigurations	Grants permission to describe one or more launch configurations. If you omit the list of names, then the call describes all launch configurations			List
DescribeLifecycleHookTypes	Grants permission to describe the available types of lifecycle hooks			List
DescribeLifecycleHooks	Grants permission to describe the lifecycle hooks for the specified Auto Scaling group			List
DescribeLoadBalancerTargetGroups	Grants permission to describe the target groups for the specified Auto Scaling group			List
DescribeLoadBalancers	Grants permission to describe the load balancers for the specified Auto Scaling group			List
DescribeMetricCollectionTypes	Grants permission to describe the available CloudWatch metrics for Auto Scaling			List
DescribeNotificationConfigurations	Grants permission to describe the notification actions associated with the specified Auto Scaling group			List
DescribePolicies	Grants permission to describe the policies for the specified Auto Scaling group			List
DescribeScalingActivities	Grants permission to describe one or more scaling activities for the specified Auto Scaling group			List
DescribeScalingProcessTypes	Grants permission to describe the scaling process types for use with ResumeProcesses and SuspendProcesses			List
DescribeScheduledActions	Grants permission to describe the actions scheduled for your Auto Scaling group that haven't run			List
DescribeTags	Grants permission to describe the specified tags			Read
DescribeTerminationPolicyTypes	Grants permission to describe the termination policies supported by Auto Scaling			List
DescribeTrafficSources	Grants permission to describe the target groups for the specified Auto Scaling group			List
DescribeWarmPool	Grants permission to describe the warm pool associated with the Auto Scaling group			List
DetachInstances	Grants permission to remove one or more instances from the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DetachLoadBalancerTargetGroups	Grants permission to detach one or more target groups from the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} autoscaling:TargetGroupARNs aws:ResourceTag/${TagKey}	Write
DetachLoadBalancers	Grants permission to remove one or more load balancers from the specified Auto Scaling group	autoScalingGroup*	autoscaling:LoadBalancerNames autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
DetachTrafficSources	Grants permission to detach one or more traffic sources from an Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} autoscaling:TrafficSourceIdentifiers aws:ResourceTag/${TagKey}	Write
DisableMetricsCollection	Grants permission to disable monitoring of the specified metrics for the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
EnableMetricsCollection	Grants permission to enable monitoring of the specified metrics for the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
EnterStandby	Grants permission to move the specified instances into Standby mode	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
ExecutePolicy	Grants permission to execute the specified policy	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
ExitStandby	Grants permission to move the specified instances out of Standby mode	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
GetPredictiveScalingForecast	Grants permission to retrieve the forecast data for a predictive scaling policy			List
LaunchInstances	Grants permission to launch one or more EC2 instances in the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
PutAccountSetting	Grants permission to modify an account setting for your account			Write
PutLifecycleHook	Grants permission to create or update a lifecycle hook for the specified Auto Scaling Group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
PutNotificationConfiguration	Grants permission to configure an Auto Scaling group to send notifications when specified events take place	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
PutScalingPolicy	Grants permission to create or update a policy for an Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
PutScheduledUpdateGroupAction	Grants permission to create or update a scheduled scaling action for an Auto Scaling group	autoScalingGroup*	autoscaling:MaxSize autoscaling:MinSize autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
PutWarmPool	Grants permission to create or update the warm pool associated with the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
RecordLifecycleActionHeartbeat	Grants permission to record a heartbeat for the lifecycle action associated with the specified token or instance	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
ResumeProcesses	Grants permission to resume the specified suspended Auto Scaling processes, or all suspended process, for the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
RollbackInstanceRefresh	Grants permission to rollback an instance refresh operation in progress	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
SetDesiredCapacity	Grants permission to set the size of the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
SetInstanceHealth	Grants permission to set the health status of the specified instance	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
SetInstanceProtection	Grants permission to update the instance protection settings of the specified instances	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
StartInstanceRefresh	Grants permission to start a new instance refresh operation	autoScalingGroup*	autoscaling:ImageId autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
SuspendProcesses	Grants permission to suspend the specified Auto Scaling processes, or all processes, for the specified Auto Scaling group	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
TerminateInstanceInAutoScalingGroup	Grants permission to terminate the specified instance and optionally adjust the desired group size	autoScalingGroup*	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}	Write
UpdateAutoScalingGroup	Grants permission to update the configuration for the specified Auto Scaling group	autoScalingGroup*	autoscaling:CapacityReservationIds autoscaling:CapacityReservationResourceGroupArns autoscaling:ImageId autoscaling:InstanceTypes autoscaling:LaunchConfigurationName autoscaling:LaunchTemplateVersionSpecified autoscaling:MaxSize autoscaling:MinSize autoscaling:ResourceTag/${TagKey} autoscaling:VPCZoneIdentifiers aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon EC2 Auto Scaling

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
autoScalingGroup	arn:${Partition}:autoscaling:${Region}:${Account}:autoScalingGroup:${GroupId}:autoScalingGroupName/${GroupFriendlyName}	autoscaling:ResourceTag/${TagKey} aws:ResourceTag/${TagKey}
launchConfiguration	arn:${Partition}:autoscaling:${Region}:${Account}:launchConfiguration:${Id}:launchConfigurationName/${LaunchConfigurationName}

Resource types

ARN

Condition keys

autoScalingGroup

arn:${Partition}:autoscaling:${Region}:${Account}:autoScalingGroup:${GroupId}:autoScalingGroupName/${GroupFriendlyName}

autoscaling:ResourceTag/${TagKey}

aws:ResourceTag/${TagKey}

launchConfiguration

arn:${Partition}:autoscaling:${Region}:${Account}:launchConfiguration:${Id}:launchConfigurationName/${LaunchConfigurationName}

Condition keys for Amazon EC2 Auto Scaling

Amazon EC2 Auto Scaling defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
autoscaling:CapacityReservationIds	Filters access based on the Capacity Reservation IDs	ArrayOfString
autoscaling:CapacityReservationResourceGroupArns	Filters access based on the ARN of a Capacity Reservation resource group	ArrayOfString
autoscaling:ForceDelete	Filters access based on whether the force delete option is specified when deleting an Auto Scaling group	Bool
autoscaling:ImageId	Filters access based on the AMI ID for the launch configuration	String
autoscaling:InstanceType	Filters access based on the instance type for the launch configuration	String
autoscaling:InstanceTypes	Filters access based on the instance types present as overrides to a launch template for a mixed instances policy. Use it to qualify which instance types can be explicitly defined in the policy	String
autoscaling:LaunchConfigurationName	Filters access based on the name of a launch configuration	String
autoscaling:LaunchTemplateVersionSpecified	Filters access based on whether users can specify any version of a launch template or only the Latest or Default version	Bool
autoscaling:LoadBalancerNames	Filters access based on the name of the load balancer	ArrayOfString
autoscaling:MaxSize	Filters access based on the maximum scaling size in the request	Numeric
autoscaling:MetadataHttpEndpoint	Filters access based on whether the HTTP endpoint is enabled for the instance metadata service	String
autoscaling:MetadataHttpPutResponseHopLimit	Filters access based on the allowed number of hops when calling the instance metadata service	Numeric
autoscaling:MetadataHttpTokens	Filters access based on whether tokens are required when calling the instance metadata service (optional or required)	String
autoscaling:MinSize	Filters access based on the minimum scaling size in the request	Numeric
autoscaling:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
autoscaling:SpotPrice	Filters access based on the price for Spot Instances for the launch configuration	Numeric
autoscaling:TargetGroupARNs	Filters access based on the ARN of a target group	ArrayOfARN
autoscaling:TrafficSourceIdentifiers	Filters access based on the identifiers of the traffic sources	ArrayOfString
autoscaling:VPCZoneIdentifiers	Filters access based on the identifier of a VPC zone	ArrayOfString
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon EC2 (ec2)

Amazon EC2 Image Builder (imagebuilder)