AWS AWSEC2 documentation change

Service: AWSEC2 · 2025-07-10 · Documentation medium

File: AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md

Summary

Modified IAM policy examples and added service-linked role permission

Security assessment

Added iam:CreateServiceLinkedRole permission requirement documentation for EC2 Instance Connect Endpoint configuration, which is a security feature. No evidence of addressing an existing vulnerability.

Diff

diff --git a/AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md b/AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md
index 4754c7808..47c41d863 100644
--- a//AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md
+++ b//AWSEC2/latest/UserGuide/permissions-for-ec2-instance-connect-endpoint.md
@@ -55,0 +56,6 @@ In the following example IAM policy, the `Resource` section grants permission to
+JSON
+    
+
+****
+    
+    
@@ -65 +71,2 @@ In the following example IAM policy, the `Resource` section grants permission to
-                    "ec2:CreateTags"
+                    "ec2:CreateTags",
+                    "iam:CreateServiceLinkedRole"
@@ -68,6 +75 @@ In the following example IAM policy, the `Resource` section grants permission to
-                "Resource": [
-                    "arn:aws:ec2:region:account-id:subnet/*",
-                    "arn:aws:ec2:region:account-id:security-group/*",
-                    "arn:aws:ec2:region:account-id:network-interface/*",
-                    "arn:aws:ec2:region:account-id:instance-connect-endpoint/*"
-                ]
+                "Resource": "arn:aws:ec2:region:account-id:subnet/*"
@@ -77 +79 @@ In the following example IAM policy, the `Resource` section grants permission to
-                    "iam:CreateServiceLinkedRole"
+                    "ec2:CreateNetworkInterface"
@@ -80,3 +82 @@ In the following example IAM policy, the `Resource` section grants permission to
-                "Resource": [
-                    "arn:aws:iam::account-id:role/aws-service-role/ec2-instance-connect.amazonaws.com/AWSServiceRoleForEc2InstanceConnect"
-                ]
+                "Resource": "arn:aws:ec2:::security-group/*"
@@ -85 +85 @@ In the following example IAM policy, the `Resource` section grants permission to
-                "Sid": "Describe",
+                "Sid": "DescribeInstanceConnectEndpoints",
@@ -128,0 +130,8 @@ This example evaluates if the connection to the instance is established on —po
+JSON
+
+JSON
+    
+
+****
+    
+    
@@ -176,0 +187,8 @@ This example evaluates if the connection to the instance is established on port
+JSON
+
+JSON
+    
+
+****
+    
+    
@@ -212,0 +232,6 @@ The following example IAM policy allows an IAM principal to connect to an instan
+JSON
+    
+
+****
+    
+