fix: Use "AND" instead of "OR" for MP IAM

ryanwohara · ryanwohara · commit 1ba8a967ede2 · 2025-09-18T10:53:20.000-06:00
diff --git a/docs/server-admin-4.3/modules/installation/pages/phase-3-execution-environments.adoc b/docs/server-admin-4.3/modules/installation/pages/phase-3-execution-environments.adoc
@@ -683,21 +683,6 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY
         }
       }
     },
-    {
-      "Action": [
-        "ec2:CreateTags",
-        "ec2:StartInstances",
-        "ec2:StopInstances",
-        "ec2:TerminateInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:ec2:*:*:*/*",
-      "Condition": {
-        "StringEquals": {
-          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
-        }
-      }
-    },
     {
       "Action": [
         "ec2:RunInstances",
@@ -709,7 +694,8 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY
       "Resource": "arn:aws:ec2:*:*:subnet/*",
       "Condition": {
         "StringEquals": {
-          "ec2:Vpc": "<VPC_ID>"
+          "ec2:Vpc": "<VPC_ID>",
+          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
         }
       }
     }
@@ -815,21 +801,6 @@ Create a `policy.json` file with the following content. You should fill in the I
         }
       }
     },
-    {
-      "Action": [
-        "ec2:CreateTags",
-        "ec2:StartInstances",
-        "ec2:StopInstances",
-        "ec2:TerminateInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:ec2:*:*:*/*",
-      "Condition": {
-        "StringEquals": {
-          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
-        }
-      }
-    },
     {
       "Action": [
         "ec2:RunInstances",
@@ -841,7 +812,8 @@ Create a `policy.json` file with the following content. You should fill in the I
       "Resource": "arn:aws:ec2:*:*:subnet/*",
       "Condition": {
         "StringEquals": {
-          "ec2:Vpc": "<VPC_ID>"
+          "ec2:Vpc": "<VPC_ID>",
+          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
         }
       }
     }
diff --git a/docs/server-admin-4.7/modules/ROOT/partials/installation/phase-3.adoc b/docs/server-admin-4.7/modules/ROOT/partials/installation/phase-3.adoc
@@ -740,21 +740,6 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY
         }
       }
     },
-    {
-      "Action": [
-        "ec2:CreateTags",
-        "ec2:StartInstances",
-        "ec2:StopInstances",
-        "ec2:TerminateInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:ec2:*:*:*/*",
-      "Condition": {
-        "StringEquals": {
-          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
-        }
-      }
-    },
     {
       "Action": [
         "ec2:RunInstances",
@@ -770,6 +755,9 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_1>",
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_2>"
           ]
+        },
+        "StringEquals": {
+          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
         }
       }
     }
@@ -882,21 +870,6 @@ Create a `policy.json` file with the following content. You should fill in the I
         }
       }
     },
-    {
-      "Action": [
-        "ec2:CreateTags",
-        "ec2:StartInstances",
-        "ec2:StopInstances",
-        "ec2:TerminateInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:ec2:*:*:*/*",
-      "Condition": {
-        "StringEquals": {
-          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
-        }
-      }
-    },
     {
       "Action": [
         "ec2:RunInstances",
@@ -912,6 +885,9 @@ Create a `policy.json` file with the following content. You should fill in the I
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_1>",
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_2>"
           ]
+        },
+        "StringEquals": {
+          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
         }
       }
     }
diff --git a/docs/server-admin-4.8/modules/ROOT/partials/installation/phase-3.adoc b/docs/server-admin-4.8/modules/ROOT/partials/installation/phase-3.adoc
@@ -774,21 +774,6 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY
         }
       }
     },
-    {
-      "Action": [
-        "ec2:CreateTags",
-        "ec2:StartInstances",
-        "ec2:StopInstances",
-        "ec2:TerminateInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:ec2:*:*:*/*",
-      "Condition": {
-        "StringEquals": {
-          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
-        }
-      }
-    },
     {
       "Action": [
         "ec2:RunInstances",
@@ -804,6 +789,9 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_1>",
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_2>"
           ]
+        },
+        "StringEquals": {
+          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
         }
       }
     }
@@ -916,21 +904,6 @@ Create a `policy.json` file with the following content. You should fill in the I
         }
       }
     },
-    {
-      "Action": [
-        "ec2:CreateTags",
-        "ec2:StartInstances",
-        "ec2:StopInstances",
-        "ec2:TerminateInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:ec2:*:*:*/*",
-      "Condition": {
-        "StringEquals": {
-          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
-        }
-      }
-    },
     {
       "Action": [
         "ec2:RunInstances",
@@ -946,6 +919,9 @@ Create a `policy.json` file with the following content. You should fill in the I
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_1>",
             "arn:aws:ec2:*:*:subnet/<SUBNET_ID_2>"
           ]
+        },
+        "StringEquals": {
+          "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"
         }
       }
     }

Original file line number	Diff line number	Diff line change
`@@ -683,21 +683,6 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY`
`683`	`683`	`}`
`684`	`684`	`}`
`685`	`685`	`},`
`686`		`- {`
`687`		`- "Action": [`
`688`		`- "ec2:CreateTags",`
`689`		`- "ec2:StartInstances",`
`690`		`- "ec2:StopInstances",`
`691`		`- "ec2:TerminateInstances"`
`692`		`- ],`
`693`		`- "Effect": "Allow",`
`694`		`- "Resource": "arn:aws:ec2:::/",`
`695`		`- "Condition": {`
`696`		`- "StringEquals": {`
`697`		`- "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`698`		`- }`
`699`		`- }`
`700`		`- },`
`701`	`686`	`{`
`702`	`687`	`"Action": [`
`703`	`688`	`"ec2:RunInstances",`
`@@ -709,7 +694,8 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY`
`709`	`694`	`"Resource": "arn:aws:ec2:::subnet/*",`
`710`	`695`	`"Condition": {`
`711`	`696`	`"StringEquals": {`
`712`		`- "ec2:Vpc": "<VPC_ID>"`
	`697`	`+ "ec2:Vpc": "<VPC_ID>",`
	`698`	`+ "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`713`	`699`	`}`
`714`	`700`	`}`
`715`	`701`	`}`
@@ -815,21 +801,6 @@ Create a `policy.json` file with the following content. You should fill in the I
`815`	`801`	`}`
`816`	`802`	`}`
`817`	`803`	`},`
`818`		`- {`
`819`		`- "Action": [`
`820`		`- "ec2:CreateTags",`
`821`		`- "ec2:StartInstances",`
`822`		`- "ec2:StopInstances",`
`823`		`- "ec2:TerminateInstances"`
`824`		`- ],`
`825`		`- "Effect": "Allow",`
`826`		`- "Resource": "arn:aws:ec2:::/",`
`827`		`- "Condition": {`
`828`		`- "StringEquals": {`
`829`		`- "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`830`		`- }`
`831`		`- }`
`832`		`- },`
`833`	`804`	`{`
`834`	`805`	`"Action": [`
`835`	`806`	`"ec2:RunInstances",`
@@ -841,7 +812,8 @@ Create a `policy.json` file with the following content. You should fill in the I
`841`	`812`	`"Resource": "arn:aws:ec2:::subnet/*",`
`842`	`813`	`"Condition": {`
`843`	`814`	`"StringEquals": {`
`844`		`- "ec2:Vpc": "<VPC_ID>"`
	`815`	`+ "ec2:Vpc": "<VPC_ID>",`
	`816`	`+ "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`845`	`817`	`}`
`846`	`818`	`}`
`847`	`819`	`}`
Original file line number	Diff line number	Diff line change
`@@ -740,21 +740,6 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY`
`740`	`740`	`}`
`741`	`741`	`}`
`742`	`742`	`},`
`743`		`- {`
`744`		`- "Action": [`
`745`		`- "ec2:CreateTags",`
`746`		`- "ec2:StartInstances",`
`747`		`- "ec2:StopInstances",`
`748`		`- "ec2:TerminateInstances"`
`749`		`- ],`
`750`		`- "Effect": "Allow",`
`751`		`- "Resource": "arn:aws:ec2:::/",`
`752`		`- "Condition": {`
`753`		`- "StringEquals": {`
`754`		`- "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`755`		`- }`
`756`		`- }`
`757`		`- },`
`758`	`743`	`{`
`759`	`744`	`"Action": [`
`760`	`745`	`"ec2:RunInstances",`
`@@ -770,6 +755,9 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY`
`770`	`755`	`"arn:aws:ec2:::subnet/<SUBNET_ID_1>",`
`771`	`756`	`"arn:aws:ec2:::subnet/<SUBNET_ID_2>"`
`772`	`757`	`]`
	`758`	`+ },`
	`759`	`+ "StringEquals": {`
	`760`	`+ "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`773`	`761`	`}`
`774`	`762`	`}`
`775`	`763`	`}`
@@ -882,21 +870,6 @@ Create a `policy.json` file with the following content. You should fill in the I
`882`	`870`	`}`
`883`	`871`	`}`
`884`	`872`	`},`
`885`		`- {`
`886`		`- "Action": [`
`887`		`- "ec2:CreateTags",`
`888`		`- "ec2:StartInstances",`
`889`		`- "ec2:StopInstances",`
`890`		`- "ec2:TerminateInstances"`
`891`		`- ],`
`892`		`- "Effect": "Allow",`
`893`		`- "Resource": "arn:aws:ec2:::/",`
`894`		`- "Condition": {`
`895`		`- "StringEquals": {`
`896`		`- "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`897`		`- }`
`898`		`- }`
`899`		`- },`
`900`	`873`	`{`
`901`	`874`	`"Action": [`
`902`	`875`	`"ec2:RunInstances",`
@@ -912,6 +885,9 @@ Create a `policy.json` file with the following content. You should fill in the I
`912`	`885`	`"arn:aws:ec2:::subnet/<SUBNET_ID_1>",`
`913`	`886`	`"arn:aws:ec2:::subnet/<SUBNET_ID_2>"`
`914`	`887`	`]`
	`888`	`+ },`
	`889`	`+ "StringEquals": {`
	`890`	`+ "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`915`	`891`	`}`
`916`	`892`	`}`
`917`	`893`	`}`
Original file line number	Diff line number	Diff line change
`@@ -774,21 +774,6 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY`
`774`	`774`	`}`
`775`	`775`	`}`
`776`	`776`	`},`
`777`		`- {`
`778`		`- "Action": [`
`779`		`- "ec2:CreateTags",`
`780`		`- "ec2:StartInstances",`
`781`		`- "ec2:StopInstances",`
`782`		`- "ec2:TerminateInstances"`
`783`		`- ],`
`784`		`- "Effect": "Allow",`
`785`		`- "Resource": "arn:aws:ec2:::/",`
`786`		`- "Condition": {`
`787`		`- "StringEquals": {`
`788`		`- "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`789`		`- }`
`790`		`- }`
`791`		`- },`
`792`	`777`	`{`
`793`	`778`	`"Action": [`
`794`	`779`	`"ec2:RunInstances",`
`@@ -804,6 +789,9 @@ aws iam create-policy --policy-name circleci-vm --policy-document file://<POLICY`
`804`	`789`	`"arn:aws:ec2:::subnet/<SUBNET_ID_1>",`
`805`	`790`	`"arn:aws:ec2:::subnet/<SUBNET_ID_2>"`
`806`	`791`	`]`
	`792`	`+ },`
	`793`	`+ "StringEquals": {`
	`794`	`+ "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`807`	`795`	`}`
`808`	`796`	`}`
`809`	`797`	`}`
@@ -916,21 +904,6 @@ Create a `policy.json` file with the following content. You should fill in the I
`916`	`904`	`}`
`917`	`905`	`}`
`918`	`906`	`},`
`919`		`- {`
`920`		`- "Action": [`
`921`		`- "ec2:CreateTags",`
`922`		`- "ec2:StartInstances",`
`923`		`- "ec2:StopInstances",`
`924`		`- "ec2:TerminateInstances"`
`925`		`- ],`
`926`		`- "Effect": "Allow",`
`927`		`- "Resource": "arn:aws:ec2:::/",`
`928`		`- "Condition": {`
`929`		`- "StringEquals": {`
`930`		`- "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`931`		`- }`
`932`		`- }`
`933`		`- },`
`934`	`907`	`{`
`935`	`908`	`"Action": [`
`936`	`909`	`"ec2:RunInstances",`
@@ -946,6 +919,9 @@ Create a `policy.json` file with the following content. You should fill in the I
`946`	`919`	`"arn:aws:ec2:::subnet/<SUBNET_ID_1>",`
`947`	`920`	`"arn:aws:ec2:::subnet/<SUBNET_ID_2>"`
`948`	`921`	`]`
	`922`	`+ },`
	`923`	`+ "StringEquals": {`
	`924`	`+ "ec2:ResourceTag/ManagedBy": "circleci-machine-provisioner"`
`949`	`925`	`}`
`950`	`926`	`}`
`951`	`927`	`}`