AWS EC2 actions

This page provides a reference for AWS EC2 actions available in the workflow automation actions catalog. Use these actions to manage EC2 instances, EBS volumes and snapshots, Elastic IP addresses, Amazon Machine Images (AMIs), security groups, key pairs, and EC2 resource tags.

Prerequisites

Before using AWS actions in workflow automation, ensure you have:

An AWS account with appropriate permissions.
AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials).
The necessary IAM permissions for the specific AWS services you plan to use.

See Set up AWS credentials for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions.

Run instances

The action identifier is aws.ec2.runInstances.

Launches the specified number of instances using an AMI for which you have permissions. If you don't specify a subnet ID, the default VPC subnet is used. If any AMIs have a product code the user hasn't subscribed to, the request fails.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances will be launched.	`us-east-2`
`imageId`	String	Required. The ID of the AMI to use for the instance.	`ami-0ca4d5db4872d0c28`
`instanceType`	String	Required. The instance type to use for the instance.	`t2.micro`
`minCount`	Int	Required. Minimum number of instances to launch.	`1`
`maxCount`	Int	Required. Maximum number of instances to launch.	`10`
`parameters`	Map	Optional. Additional boto3 API parameters for the run_instances call.	`{"EbsOptimized": false, "TagSpecifications": [{"ResourceType": "instance", "Tags": [{"Key": "Name", "Value": "My-Web-Server"}]}]}`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

Tip

The parameters map accepts any optional argument available in the boto3 API, allowing you to dynamically construct requests.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the run_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe an instance

The action identifier is aws.ec2.describeInstances.

Describes the specified instances or all instances.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Optional. List of instance IDs to describe.	`["i-0123456789abcdef0", "i-0fedcba9876543210"]`
`filters`	List	Optional. Filters to apply to the describe request.	`[{"Name": "instance-state-name", "Values": ["running"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`abcdefgh`
`maxResults`	Int	Optional. Maximum number of results to return.	`100`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`"The parameter instancesSet cannot be used with the parameter maxResults"`

Important

If you specify instance IDs, the output includes information for only the specified instances. If you specify filters, the output includes information for only those instances that meet the filter criteria. If you specify neither, the output includes information for all instances. The instanceIds parameter cannot be used together with maxResults.

Restart instances

The action identifier is aws.ec2.startInstances.

Starts an Amazon EBS-backed instance that you previously stopped.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Required. List of instance IDs to start.	`["i-0123456789abcdef0", "i-0fedcba9876543210"]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the start_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`"The parameter instancesSet cannot be used with the parameter maxResults"`

Stop instances

The action identifier is aws.ec2.stopInstances.

Stops an Amazon EBS-backed instance.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Required. List of instance IDs to stop.	`["i-0123456789abcdef0", "i-0fedcba9876543210"]`
`hibernate`	Boolean	Optional. Hibernate the instance instead of stopping it. Default: `false`.	`false`
`force`	Boolean	Optional. Force stop the instance. Default: `false`.	`false`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the stop_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`"An error occurred (InvalidInstanceID.Malformed) when calling the StopInstances operation: The instance ID 'i-123456789' is malformed"`

Request an instance reboot

The action identifier is aws.ec2.rebootInstances.

Requests a reboot of the specified instances. This operation is asynchronous — it only queues a request to reboot the specified instances. The operation succeeds if the instances are valid and belong to you. Requests to reboot terminated instances are ignored. If an instance does not cleanly shut down within a few minutes, Amazon EC2 performs a hard reboot.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Required. List of instance IDs to reboot.	`["i-0123456789abcdef0", "i-0fedcba9876543210"]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the reboot_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Shut down instances

The action identifier is aws.ec2.terminateInstances.

Shuts down the specified instances. This operation is idempotent — if you terminate an instance more than once, each call succeeds. If you specify multiple instances and the request fails (for example, because of a single incorrect instance ID), none of the instances are terminated.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Required. IDs of the instances to terminate.	`["i-0123456789abcdef0", "i-0fedcba9876543210"]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the terminate_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`"An error occurred (InvalidInstanceID.Malformed) when calling the TerminateInstances operation: The instance ID 'i-012345678' is malformed"`

Create an EBS snapshot

The action identifier is aws.ec2.createSnapshot.

Creates a snapshot of an EBS volume and stores it in Amazon S3. You can use snapshots for backups, to make copies of EBS volumes, and to save data before shutting down an instance. The location of the source EBS volume determines where you can create the snapshot.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the EBS volume is located.	`us-east-2`
`volumeId`	String	Required. The ID of the EBS volume to snapshot.	`vol-0123456789abcdef0`
`description`	String	Optional. A description for the snapshot.	`This is a test snapshot`
`outpostArn`	String	Optional. The Amazon Resource Name (ARN) of the Outpost on which to create the snapshot.	`arn:aws:ec2:us-east-1:123456789012:outpost/op-1a2b3c4d5e6f7g8h9`
`tagSpecifications`	List	Optional. Tags to apply to the snapshot at creation.	`[{"ResourceType":"snapshot","Tags":[{"Key":"testKey","Value":"testValue"}]}]`
`location`	String	Optional. The location of the snapshot. Valid values: `regional`, `local`.	`regional`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the create_snapshot boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Delete a snapshot

The action identifier is aws.ec2.deleteSnapshot.

Deletes the specified snapshot. You cannot delete a snapshot of the root device of an EBS volume used by a registered AMI — you must first deregister the AMI before you can delete the snapshot.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the snapshot is located.	`us-east-2`
`snapshotId`	String	Required. The ID of the snapshot to delete.	`snapshot-id-1`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the delete_snapshot boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`"Failed to delete snapshot"`

Allocate an Elastic IP address

The action identifier is aws.ec2.allocateAddress.

Allocates a new Elastic IP address for use with EC2 instances in a VPC.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the address is allocated.	`us-east-2`
`domain`	String	Optional. Scope of the address. Use `vpc` for VPC instances.	`vpc`
`address`	String	Optional. A specific Elastic IP address to recover that you previously released.	`203.0.113.25`
`networkBorderGroup`	String	Optional. Limits the group from which the IP address is advertised.	`us-east-2`
`tagSpecifications`	List	Optional. Tags applied to the address at allocation time.	`[{"ResourceType": "elastic-ip", "Tags": [{"Key": "Name", "Value": "nat-eip"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "allocationId", "expression": ".response.AllocationId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the allocate_address boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Associate an Elastic IP address

The action identifier is aws.ec2.associateAddress.

Associates an Elastic IP address with an EC2 instance or network interface.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the association is made.	`us-east-2`
`allocationId`	String	Optional. The Elastic IP allocation ID to associate. Use with `instanceId` or `networkInterfaceId` for VPC instances.	`eipalloc-0123456789abcdef0`
`instanceId`	String	Optional. The instance to associate the address with.	`i-0123456789abcdef0`
`publicIp`	String	Optional. Alternative to `allocationId` for EC2-Classic addresses.	`203.0.113.25`
`networkInterfaceId`	String	Optional. Target network interface instead of an instance.	`eni-0123456789abcdef0`
`privateIpAddress`	String	Optional. A specific private IP on the network interface to associate with.	`10.0.1.25`
`allowReassociation`	Boolean	Optional. Allow the address to move off an existing association. Default: `false`.	`false`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "associationId", "expression": ".response.AssociationId"}]`

Important

Only certain combinations of identifiers are valid. For VPC instances, use allocationId with instanceId or networkInterfaceId. For EC2-Classic instances, use publicIp with instanceId. Do not mix the two forms.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the associate_address boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Disassociate an Elastic IP address

The action identifier is aws.ec2.disassociateAddress.

Disassociates an Elastic IP address from its current instance or network interface.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the association exists.	`us-east-2`
`associationId`	String	Optional. The association ID returned by `aws.ec2.associateAddress`. Use for VPC addresses.	`eipassoc-0123456789abcdef0`
`publicIp`	String	Optional. Alternative to `associationId` for EC2-Classic addresses.	`203.0.113.25`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

Important

Use exactly one identifier matching the domain the address was associated in. For VPC addresses, use associationId. For EC2-Classic addresses, use publicIp.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the disassociate_address boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Release an Elastic IP address

The action identifier is aws.ec2.releaseAddress.

Releases an Elastic IP address back to the AWS pool. The address must already be disassociated before it can be released.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the address is allocated.	`us-east-2`
`allocationId`	String	Optional. The allocation ID of the VPC address to release.	`eipalloc-0123456789abcdef0`
`publicIp`	String	Optional. Alternative to `allocationId` for EC2-Classic addresses.	`203.0.113.25`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the release_address boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe Elastic IP addresses

The action identifier is aws.ec2.describeAddresses.

Describes Elastic IP addresses and their current associations.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`publicIps`	List	Optional. Restrict results to these public IP addresses.	`["203.0.113.25"]`
`allocationIds`	List	Optional. Restrict results to these allocation IDs.	`["eipalloc-0123456789abcdef0"]`
`filters`	List	Optional. AWS filters to apply to the query.	`[{"Name": "domain", "Values": ["vpc"]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "addresses", "expression": ".response.Addresses"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_addresses boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Create tags

The action identifier is aws.ec2.createTags.

Adds or overwrites tags on any EC2 resource — instances, volumes, snapshots, security groups, AMIs, and so on. An existing tag with the same key is overwritten.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the resources are located.	`us-east-2`
`resources`	List	Required. IDs of the EC2 resources to tag.	`["i-0123456789abcdef0"]`
`tags`	List	Required. Tag key/value pairs to apply.	`[{"Key": "Name", "Value": "app-server"}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the create_tags boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Delete tags

The action identifier is aws.ec2.deleteTags.

Removes tags from any EC2 resource. Omit the tags field to remove all tags from the specified resources.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the resources are located.	`us-east-2`
`resources`	List	Required. IDs of the EC2 resources to remove tags from.	`["i-0123456789abcdef0"]`
`tags`	List	Optional. Tags to remove. Omit `Value` to delete the key regardless of its value. Omit the field entirely to remove all tags.	`[{"Key": "Name"}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the delete_tags boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe tags

The action identifier is aws.ec2.describeTags.

Describes tags across any EC2 resource type, with optional filtering by resource ID, resource type, key, or value.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`filters`	List	Optional. AWS filters applied to the query. Filter by `resource-id`, `resource-type`, `key`, or `value`.	`[{"Name": "resource-id", "Values": ["i-0123456789abcdef0"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of tags to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "tags", "expression": ".response.Tags"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_tags boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Create a volume

The action identifier is aws.ec2.createVolume.

Creates a new EBS volume in a given availability zone. A volume can only be attached to an instance in the same availability zone.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the volume is created.	`us-east-2`
`availabilityZone`	String	Required. The availability zone in which to create the volume.	`us-east-2a`
`size`	Int	Optional. Volume size in GiB. Required if `snapshotId` is not supplied.	`100`
`volumeType`	String	Optional. EBS volume type. Valid values: `gp2`, `gp3`, `io1`, `io2`, `st1`, `sc1`, `standard`. Default: `gp2`.	`gp3`
`snapshotId`	String	Optional. Snapshot to restore the volume from.	`snap-0123456789abcdef0`
`iops`	Int	Optional. Provisioned IOPS. Only valid for `gp3`, `io1`, and `io2` volumes.	`3000`
`throughput`	Int	Optional. Throughput in MiB/s. Only valid for `gp3` volumes.	`125`
`tagSpecifications`	List	Optional. Tags applied to the volume at creation time.	`[{"ResourceType": "volume", "Tags": [{"Key": "Name", "Value": "app-data"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "volumeId", "expression": ".response.VolumeId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the create_volume boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Delete a volume

The action identifier is aws.ec2.deleteVolume.

Deletes an EBS volume. The volume must be in the available state (fully detached) before it can be deleted.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the volume is located.	`us-east-2`
`volumeId`	String	Required. The ID of the volume to delete.	`vol-0123456789abcdef0`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the delete_volume boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Attach a volume

The action identifier is aws.ec2.attachVolume.

Attaches an EBS volume to a running or stopped EC2 instance. The volume and instance must be in the same availability zone.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the volume and instance are located.	`us-east-2`
`volumeId`	String	Required. The ID of the volume to attach. Must be in the `available` state.	`vol-0123456789abcdef0`
`instanceId`	String	Required. The instance to attach to. Must be `running` or `stopped`.	`i-0123456789abcdef0`
`device`	String	Required. The device name the volume is exposed as on the instance.	`/dev/sdf`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "attachmentState", "expression": ".response.State"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the attach_volume boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Detach a volume

The action identifier is aws.ec2.detachVolume.

Detaches an EBS volume from an EC2 instance.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the volume is located.	`us-east-2`
`volumeId`	String	Required. The ID of the volume to detach.	`vol-0123456789abcdef0`
`instanceId`	String	Optional. Narrows the detach to a specific instance. Useful when the volume is multi-attached.	`i-0123456789abcdef0`
`device`	String	Optional. Narrows the detach to a specific device name on the instance.	`/dev/sdf`
`force`	Boolean	Optional. Forces detachment without unmounting from the guest OS. Can cause data loss or filesystem corruption. Default: `false`.	`false`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "detachmentState", "expression": ".response.State"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the detach_volume boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Modify a volume

The action identifier is aws.ec2.modifyVolume.

Resizes an EBS volume or changes its volume type, IOPS, or throughput. EBS volumes can only be grown, never shrunk.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the volume is located.	`us-east-2`
`volumeId`	String	Required. The ID of the volume to modify.	`vol-0123456789abcdef0`
`size`	Int	Optional. New size in GiB.	`200`
`volumeType`	String	Optional. New volume type.	`gp3`
`iops`	Int	Optional. New provisioned IOPS. Only valid for `gp3`, `io1`, and `io2` volumes.	`4000`
`throughput`	Int	Optional. New throughput in MiB/s. Only valid for `gp3` volumes.	`250`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "modificationState", "expression": ".response.VolumeModification.ModificationState"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the modify_volume boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe volumes

The action identifier is aws.ec2.describeVolumes.

Describes EBS volumes and their attachment state.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`volumeIds`	List	Optional. Restrict results to specific volume IDs. Omit to describe all volumes in the region.	`["vol-0123456789abcdef0"]`
`filters`	List	Optional. Server-side filters, for example by `status`, `availability-zone`, or `volume-type`.	`[{"Name": "status", "Values": ["available"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of volumes to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "volumes", "expression": ".response.Volumes"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_volumes boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Copy a snapshot

The action identifier is aws.ec2.copySnapshot.

Copies an EBS snapshot to another region for backup and disaster recovery. The region field specifies the destination region.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. The destination region the snapshot is copied into.	`us-west-2`
`sourceSnapshotId`	String	Required. The ID of the snapshot to copy.	`snap-0123456789abcdef0`
`sourceRegion`	String	Required. The region the source snapshot currently lives in.	`us-east-1`
`description`	String	Optional. Description applied to the new snapshot.	`Cross-region DR copy`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "snapshotId", "expression": ".response.SnapshotId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the copy_snapshot boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe snapshots

The action identifier is aws.ec2.describeSnapshots.

Describes EBS snapshots by owner, volume, or filter criteria.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`snapshotIds`	List	Optional. Restrict results to specific snapshot IDs.	`["snap-0123456789abcdef0"]`
`ownerIds`	List	Optional. Filter by snapshot owner. Use `self` to return only snapshots owned by the calling account.	`["self"]`
`filters`	List	Optional. AWS filters, for example by volume, status, or tag.	`[{"Name": "volume-id", "Values": ["vol-0123456789abcdef0"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of snapshots to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "snapshots", "expression": ".response.Snapshots"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_snapshots boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Create an image

The action identifier is aws.ec2.createImage.

Creates an Amazon Machine Image (AMI) from a running or stopped EC2 instance.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instance is located.	`us-east-2`
`instanceId`	String	Required. The EC2 instance to capture the image from.	`i-0123456789abcdef0`
`name`	String	Required. Name for the new AMI. Must be unique within the region.	`my-server-ami-2026-09-21`
`description`	String	Optional. Free-form description for the AMI.	`Nightly backup AMI`
`noReboot`	Boolean	Optional. When `false`, AWS shuts down and reboots the instance to guarantee a filesystem-consistent image. Set `true` to skip the reboot at the cost of image consistency. Default: `false`.	`false`
`tagSpecifications`	List	Optional. Tags applied to the new AMI and its snapshots at creation time.	`[{"ResourceType": "image", "Tags": [{"Key": "Name", "Value": "nightly-backup"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "imageId", "expression": ".response.ImageId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the create_image boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Copy an image

The action identifier is aws.ec2.copyImage.

Copies an Amazon Machine Image (AMI) to another region for disaster recovery or multi-region deployments. The region field specifies the destination region.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. The destination region the copy is created in.	`us-west-2`
`sourceImageId`	String	Required. The AMI to copy.	`ami-0123456789abcdef0`
`sourceRegion`	String	Required. The region that currently holds the source AMI.	`us-east-1`
`name`	String	Optional. Name for the new AMI in the destination region.	`my-server-ami-copy`
`description`	String	Optional. Free-form description for the copied AMI.	`Cross-region DR copy`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "imageId", "expression": ".response.ImageId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the copy_image boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Deregister an image

The action identifier is aws.ec2.deregisterImage.

Deregisters an Amazon Machine Image (AMI) that you own. Deregistering an AMI does not delete its backing EBS snapshots — delete those separately to stop incurring storage costs.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the AMI is registered.	`us-east-2`
`imageId`	String	Required. The AMI to deregister. Must be an AMI owned by the calling account.	`ami-0123456789abcdef0`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the deregister_image boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe images

The action identifier is aws.ec2.describeImages.

Describes Amazon Machine Images owned by, shared with, or public to your account.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`imageIds`	List	Optional. Restrict results to specific AMI IDs.	`["ami-0123456789abcdef0"]`
`owners`	List	Optional. Scope results by owner. Accepts an AWS account ID, `self`, `amazon`, or `aws-marketplace`.	`["self"]`
`filters`	List	Optional. Server-side filters, for example by `name`, `state`, or `tag:<key>`.	`[{"Name": "name", "Values": ["my-server-ami-*"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of AMIs to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "images", "expression": ".response.Images"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_images boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe instance status

The action identifier is aws.ec2.describeInstanceStatus.

Describes the status of one or more EC2 instances, including system and instance status checks and scheduled events.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`instanceIds`	List	Optional. Instance IDs to check. If omitted, all instances are returned.	`["i-0123456789abcdef0"]`
`includeAllInstances`	Boolean	Optional. When `true`, includes instances in states other than running. Default: `false`.	`false`
`filters`	List	Optional. AWS filters to apply to the query.	`[{"Name": "instance-status.status", "Values": ["impaired"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of results to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "instanceStatuses", "expression": ".response.InstanceStatuses"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_instance_status boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe instance types

The action identifier is aws.ec2.describeInstanceTypes.

Describes the specifications (vCPU, memory, network, storage) of EC2 instance types.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`instanceTypes`	List	Optional. Specific instance types to describe.	`["t3.micro", "m5.large"]`
`filters`	List	Optional. AWS filters to apply to the query.	`[{"Name": "instance-type", "Values": ["t3.*"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of results to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "instanceTypes", "expression": ".response.InstanceTypes"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_instance_types boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Modify an instance attribute

The action identifier is aws.ec2.modifyInstanceAttribute.

Modifies a single attribute of an EC2 instance such as instance type, termination protection, user data, or source/dest check.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instance is located.	`us-east-2`
`instanceId`	String	Required. The instance whose attribute is being modified.	`i-0123456789abcdef0`
`parameters`	Map	Required. The attribute to modify in the shape the AWS API expects. Only one attribute can be modified per call.	`{"DisableApiTermination": {"Value": true}}`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

Important

Only one attribute can be modified per call. Each attribute has a different shape in the parameters map — for example, {"InstanceType": {"Value": "t3.large"}} to change the instance type, or {"DisableApiTermination": {"Value": true}} to enable termination protection. Most attributes require the instance to be stopped first.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the modify_instance_attribute boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Enable detailed monitoring

The action identifier is aws.ec2.monitorInstances.

Enables detailed CloudWatch monitoring (1-minute metrics) for one or more EC2 instances.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Required. IDs of the instances to enable detailed monitoring on.	`["i-0123456789abcdef0"]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "instanceMonitorings", "expression": ".response.InstanceMonitorings"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the monitor_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Disable detailed monitoring

The action identifier is aws.ec2.unmonitorInstances.

Disables detailed CloudWatch monitoring for one or more EC2 instances, reverting to standard 5-minute metrics.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instances are located.	`us-east-2`
`instanceIds`	List	Required. IDs of the instances to disable detailed monitoring on.	`["i-0123456789abcdef0"]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "instanceMonitorings", "expression": ".response.InstanceMonitorings"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the unmonitor_instances boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Get console output

The action identifier is aws.ec2.getConsoleOutput.

Retrieves the console output of an EC2 instance for boot and troubleshooting diagnostics. The output is base64-encoded.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instance is located.	`us-east-2`
`instanceId`	String	Required. The instance to retrieve console output from.	`i-0123456789abcdef0`
`latest`	Boolean	Optional. When `true`, returns the latest output even if it is still being processed. Default: `false`.	`true`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "output", "expression": ".response.Output"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the get_console_output boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Get Windows password data

The action identifier is aws.ec2.getPasswordData.

Retrieves the encrypted administrator password for a Windows EC2 instance. Returns an empty PasswordData field for non-Windows instances.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the instance is located.	`us-east-2`
`instanceId`	String	Required. The Windows instance to retrieve password data from.	`i-0123456789abcdef0`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "passwordData", "expression": ".response.PasswordData"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the get_password_data boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Import a key pair

The action identifier is aws.ec2.importKeyPair.

Imports an existing public key into EC2 as a key pair. AWS stores only the public key — the private key never leaves your control.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the key pair is registered.	`us-east-2`
`keyName`	String	Required. Unique name to register the imported key pair under.	`my-imported-key`
`publicKeyMaterial`	String	Required. The public key to import. Pass as a secret.	`${{ :secrets:opsPublicKeyMaterial }}`
`tagSpecifications`	List	Optional. Tags applied to the key pair at import time.	`[{"ResourceType": "key-pair", "Tags": [{"Key": "Name", "Value": "my-imported-key"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "keyPairId", "expression": ".response.KeyPairId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the import_key_pair boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Delete a key pair

The action identifier is aws.ec2.deleteKeyPair.

Deletes an EC2 key pair. Supply either keyName or keyPairId.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the key pair exists.	`us-east-2`
`keyName`	String	Optional. Name of the key pair to delete. Supply either `keyName` or `keyPairId`.	`my-key-pair`
`keyPairId`	String	Optional. ID of the key pair to delete. Supply either `keyName` or `keyPairId`.	`key-0123456789abcdef0`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the delete_key_pair boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe key pairs

The action identifier is aws.ec2.describeKeyPairs.

Describes the EC2 key pairs in an account and region.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`keyNames`	List	Optional. Restrict results to these key pair names.	`["my-key-pair"]`
`keyPairIds`	List	Optional. Restrict results to these key pair IDs.	`["key-0123456789abcdef0"]`
`filters`	List	Optional. AWS filters, for example by `key-name` or tag.	`[{"Name": "key-name", "Values": ["my-key-*"]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "keyPairs", "expression": ".response.KeyPairs"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_key_pairs boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Create a security group

The action identifier is aws.ec2.createSecurityGroup.

Creates a new EC2 security group in a VPC.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the security group is created.	`us-east-2`
`groupName`	String	Required. Name for the new security group. Must be unique within the VPC.	`web-servers-sg`
`description`	String	Required. Description for the security group.	`Security group for web servers`
`vpcId`	String	Optional. VPC in which to create the group. Defaults to the region's default VPC.	`vpc-0123456789abcdef0`
`tagSpecifications`	List	Optional. Tags applied to the group at creation time.	`[{"ResourceType": "security-group", "Tags": [{"Key": "Name", "Value": "web-servers-sg"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "groupId", "expression": ".response.GroupId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the create_security_group boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Delete a security group

The action identifier is aws.ec2.deleteSecurityGroup.

Deletes an EC2 security group. Supply either groupId (preferred) or groupName.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the security group exists.	`us-east-2`
`groupId`	String	Optional. The security group to delete. Works for any VPC. Preferred over `groupName`.	`sg-0123456789abcdef0`
`groupName`	String	Optional. Alternative to `groupId`. Only valid for groups in the default VPC.	`web-servers-sg`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the delete_security_group boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Describe security groups

The action identifier is aws.ec2.describeSecurityGroups.

Describes EC2 security groups and their inbound and outbound rules.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region to query.	`us-east-2`
`groupIds`	List	Optional. Restrict results to specific security group IDs.	`["sg-0123456789abcdef0"]`
`groupNames`	List	Optional. Restrict results by group name. Only valid for groups in the default VPC.	`["web-servers-sg"]`
`filters`	List	Optional. AWS filters, for example by `vpc-id`, `group-name`, or `tag:<key>`.	`[{"Name": "vpc-id", "Values": ["vpc-0123456789abcdef0"]}]`
`nextToken`	String	Optional. Pagination token from a previous response.	`nextToken`
`maxResults`	Int	Optional. Maximum number of groups to return per page.	`10`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "securityGroups", "expression": ".response.SecurityGroups"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	See the describe_security_groups boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Add an inbound rule

The action identifier is aws.ec2.authorizeSecurityGroupIngress.

Adds an inbound rule to an EC2 security group.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the security group exists.	`us-east-2`
`groupId`	String	Required. The security group to add the inbound rule to.	`sg-0123456789abcdef0`
`ipProtocol`	String	Optional. Flat form. Use with `fromPort`, `toPort`, and `cidrIp` for a single IPv4 rule.	`tcp`
`fromPort`	Int	Optional. Flat form. Start of the port range.	`443`
`toPort`	Int	Optional. Flat form. End of the port range.	`443`
`cidrIp`	String	Optional. Flat form. Source CIDR block allowed by the rule.	`0.0.0.0/0`
`ipPermissions`	List	Optional. Structured form. Required for multiple rules in one call, rule descriptions, IPv6 ranges, prefix lists, or source security groups.	`[{"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [{"CidrIp": "0.0.0.0/0", "Description": "HTTPS from anywhere"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

Tip

This action supports two rule forms — pick one per call. The flat form (ipProtocol, fromPort, toPort, cidrIp) is a shorthand for a single IPv4 rule. Use ipPermissions for multiple rules, descriptions, IPv6 ranges, prefix lists, or source security groups.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the authorize_security_group_ingress boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Remove an inbound rule

The action identifier is aws.ec2.revokeSecurityGroupIngress.

Removes an inbound rule from an EC2 security group. The rule specification must exactly match an existing rule.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the security group exists.	`us-east-2`
`groupId`	String	Required. The security group to remove the inbound rule from.	`sg-0123456789abcdef0`
`ipProtocol`	String	Optional. Flat form. Use with `fromPort`, `toPort`, and `cidrIp`.	`tcp`
`fromPort`	Int	Optional. Flat form. Start of the port range.	`443`
`toPort`	Int	Optional. Flat form. End of the port range.	`443`
`cidrIp`	String	Optional. Flat form. Source CIDR block of the rule being removed.	`0.0.0.0/0`
`ipPermissions`	List	Optional. Structured form. Required to revoke multiple rules in one call, or rules on IPv6 ranges, prefix lists, or source security groups.	`[{"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the revoke_security_group_ingress boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Add an outbound rule

The action identifier is aws.ec2.authorizeSecurityGroupEgress.

Adds an outbound rule to an EC2 security group using the structured ipPermissions form.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the security group exists.	`us-east-2`
`groupId`	String	Required. The security group to add the outbound rule to.	`sg-0123456789abcdef0`
`ipPermissions`	List	Required. The outbound rules to add in the structured form.	`[{"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

Important

Unlike the inbound rule actions, this action does not support the flat parameter form (cidrIp, ipProtocol, fromPort, toPort). The AWS AuthorizeSecurityGroupEgress API rejects those parameters outright. All outbound rules must use the structured ipPermissions list.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the authorize_security_group_egress boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Remove an outbound rule

The action identifier is aws.ec2.revokeSecurityGroupEgress.

Removes an outbound rule from an EC2 security group. The rule specification must exactly match an existing rule. A common use is removing the default allow-all egress rule that AWS attaches to every new security group.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the security group exists.	`us-east-2`
`groupId`	String	Required. The security group to remove the outbound rule from.	`sg-0123456789abcdef0`
`ipPermissions`	List	Required. The outbound rules to remove in the structured form. Must exactly match existing rules.	`[{"IpProtocol": "-1", "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "response", "expression": ".response"}]`

Important

Unlike the inbound rule actions, this action does not support the flat parameter form (cidrIp, ipProtocol, fromPort, toPort). All outbound rules must use the structured ipPermissions list.

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	No response body on success. See the revoke_security_group_egress boto3 reference.
`success`	Boolean	`true` or `false`
`errorMessage`	String	`""`

Prerequisites.css-21sua1{background:none;border:none;width:0;padding:0;}

Run instances

Tip

Describe an instance

Important

Restart instances

Stop instances

Request an instance reboot

Shut down instances

Create an EBS snapshot

Delete a snapshot

Allocate an Elastic IP address

Associate an Elastic IP address

Important

Disassociate an Elastic IP address

Important

Release an Elastic IP address

Describe Elastic IP addresses

Create tags

Delete tags

Describe tags

Create a volume

Delete a volume

Attach a volume

Detach a volume

Modify a volume

Describe volumes

Copy a snapshot

Describe snapshots

Create an image

Copy an image

Deregister an image

Describe images

Describe instance status

Describe instance types

Modify an instance attribute

Important

Enable detailed monitoring

Disable detailed monitoring

Get console output

Get Windows password data

Import a key pair

Delete a key pair

Describe key pairs

Create a security group

Delete a security group

Describe security groups

Add an inbound rule

Tip

Remove an inbound rule

Add an outbound rule

Important

Remove an outbound rule

Important

Prerequisites