title: Terraform create security group permissions
body: <p>I am using the following Terraform to create a security group for an EC2 instance:</p>
  
  <pre><code>resource "aws_security_group" "ecs_http_access" {
    name        = "${var.prefix}-ecs-host-sg"
    description = "HTTP Access"
  
    ingress {
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP Access"
    }
  }
  </code></pre>
  
  <p>This works fine, however I'm trying to fine tune the permissions of the user that runs this. My goal is to ensure the user can only create instance types of <code>t2.micro</code> in a specific region.</p>
  
  <p>I can successfully limit the instance type using this policy which is working fine:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": "ec2:*",
              "Resource": [
                  “*"
              ],
              "Condition": {
                  "StringEqualsIfExists": {
                      "ec2:InstanceType": "t2.micro"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>However, when specifying specific resources (I have confirmed all of them are included), it fails with <code>Error creating Security Group: UnauthorizedOperation: You are not authorized to perform this operation.</code></p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": "ec2:*",
              "Resource": [
                  "arn:aws:ec2:*:*:vpc-peering-connection/*",
                  "arn:aws:ec2:*:*:subnet/*",
                  "arn:aws:ec2:*:*:vpn-gateway/*",
                  "arn:aws:ec2:*:*:reserved-instances/*",
                  "arn:aws:ec2:*:*:vpn-connection/*",
                  "arn:aws:ec2:*:*:launch-template/*",
                  "arn:aws:ec2:*::snapshot/*",
                  "arn:aws:ec2:*:*:security-group/*",
                  "arn:aws:ec2:*:*:network-acl/*",
                  "arn:aws:ec2:*:*:placement-group/*",
                  "arn:aws:ec2:*:*:network-interface/*",
                  "arn:aws:ec2:*:*:internet-gateway/*",
                  "arn:aws:ec2:*:*:route-table/*",
                  "arn:aws:ec2:*:*:key-pair/*",
                  "arn:aws:ec2:*:*:dhcp-options/*",
                  "arn:aws:ec2:*::spot-instance-request/*",
                  "arn:aws:ec2:us-east-1:*:instance/*",
                  "arn:aws:ec2:*:*:volume/*",
                  "arn:aws:ec2:*:*:customer-gateway/*",
                  "arn:aws:ec2:*::fpga-image/*",
                  "arn:aws:ec2:*:*:vpc/*",
                  "arn:aws:ec2:*::image/*"
              ],
              "Condition": {
                  "StringEqualsIfExists": {
                      "ec2:InstanceType": "t2.micro"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>Why would it work with a wildcard on <code>Resource</code> but not when listing all of the resources individually?</p>