title: What policy Action(s) on what Resource(s) are required to run New-EC2Tag from Powershell?
body: <p>I'm attempting to run New-EC2Tag, getting the following error:</p>
  
  <pre><code>New-EC2Tag : You are not authorized to perform this operation.
  </code></pre>
  
  <p>The user policy is as follows:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
      {
          "Effect": "Allow",
          "Action": ["ec2:DescribeInstances","ec2:CreateTags"],
          "Resource": "arn:aws:ec2:ap-southeast-2:&lt;my_account_id&gt;:instance/*",
          "Condition": {
              "StringEquals": {
                  "ec2:ResourceTag/OctopusTentacle": "yes"
              }
          }
      }
      ]
  }
  </code></pre>
  
  <p>It works fine in the Policy Simulator as above.</p>
  
  <p>If I remove the condition and set Resource to * it works.  Removing the condition or setting Resource to * alone do not work.  I am running this as local Administrator on the instance.</p>
  
  <p>What else is New-EC2Tag accessing/doing that I need to grant access to?</p>