AWS IAM Show only untagged EC2 instances

Question

I'm attempting to introduce a guest IAM policy to restrict the access to the EC2 instances. I'm trying to reach that, the guest policy shows only that instances, which is not tagged with 'Department' or tagged with 'Department = Guest'.

Here is the policy, that I made for this:

Policy:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "ec2:Describe*"
        ],
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "ec2:ResourceTag/Department": "Guest"
            },
            "Null": {
                "ec2:ResourceTag/Department": "true"
            }
        }
    }
]}

The "Department = Guest" comparison is working well, but the Resource Tag existence check is not working.

Is there any other way to list the instances, which haven't got 'Department' tag?

Answer 1

The use case to control which EC2 resources in same region IAM users can see based on tag (by other means) is not possible since all EC2 describe API calls do not support resource level permission.

Hence we cannot use EC2 conditions (except ec2:Region) with "ec2:Describe*" action. So, either you give permission to see resources or don't.

Answer 2

I think that when you have multiple conditions on a single IAM statement, they are handled in an AND situation, meaning that both must be true.

Try using 2 statements, each with a single condition:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "ec2:Describe*"
        ],
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "ec2:ResourceTag/Department": "Guest"
            }
        }
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "ec2:Describe*"
        ],
        "Resource": "*",
        "Condition": {
            "Null": {
                "ec2:ResourceTag/Department": "true"
            }
        }
    }
]}