IAM policy for EBS volume with EC2 instance

Question

I am trying to create an IAM role/policy to enable my EC2 instance to be able to list and attach EBS volumes (via scripts that call the aws cli). I want this policy to allow only listing/attaching of EBS volumes that have a specific tag.

I've noticed that the script is able to list/attach volumes when I set Resources: "*" and no Conditions in my policy below. But as soon as I introduce the policy I have below, the AWS cli throws the following error:

./aws ec2 describe-volumes

An error occurred (UnauthorizedOperation) when calling the DescribeVolumes operation: You are not authorized to perform this operation.

Here is the IAM policy I have so far defined in terraform:

resource "aws_iam_role" "web_role" {
  name = "web_role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}


resource "aws_iam_instance_profile" "web_profile" {
  name = "web_profile"
  role = aws_iam_role.web_role.name
}


resource "aws_iam_role_policy" "web_disk_policy" {
  name = "web_disk_policy"
  role = aws_iam_role.web_role.id

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachVolume",
                "ec2:DetachVolume",
                "ec2:DescribeVolumes"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                  "ec2:ResourceTag/app": "web"
                }
            }
        }
    ]
}
EOF
}

And my EC2 instances is created with the following:

resource "aws_instance" "web_vm" {
  ...

  iam_instance_profile   = aws_iam_instance_profile.web_profile.name
  ...

  tags = {
    app = "web"
  }
}

And disk created with:

resource "aws_ebs_volume" "ebs-volume-1" {
  availability_zone = "us-west-2a"
  size              = 10

  tags = {
    app = "web"
  }
}

Answer 1

DescribeVolumes does not support aws:ResourceTag/${TagKey} condition, nor any other.

Answer 2

Most Describe/List type operations that target many resources aren't compatible with the conditional logic. DescribeVolumes does not work with conditions so split that off into a different statement.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachVolume",
                "ec2:DetachVolume"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                  "ec2:ResourceTag/app": "web"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeVolumes",
            "Resource": "*"
        }
    ]
}