## Grant EC2 Fleet permissions to AWS Private Locations

**Who is affected:** users with AWS Private Locations who manage the Control Plane IAM policy themselves. We recommend granting these permissions to all AWS Private Locations. If you use the [Terraform module]({{< ref "/reference/deploy/infrastructure-as-code/#aws" >}}), upgrade it to get the new permissions.

### What Changed

The Control Plane deploys AWS load generators with EC2 Fleet, which can spread a run's load generators across all configured subnets when one runs out of capacity.

### Migration Guide

Add these actions and resources to the statement of your `GatlingControlPlaneEc2Policy` that allows `ec2:RunInstances`:

```json
{
    "Effect": "Allow",
    "Action": [
        "ec2:CreateTags",
        "ec2:RunInstances",
        "ec2:CreateLaunchTemplate",
        "ec2:DeleteLaunchTemplate",
        "ec2:CreateFleet",
        "ec2:DeleteFleets"
    ],
    "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*::image/*",
        "arn:aws:ec2:*:*:launch-template/*",
        "arn:aws:ec2:*:*:fleet/*"
    ]
}
```

See the [full policy]({{< ref "/reference/deploy/private-locations/aws/installation/#policies" >}}).

### Backward Compatibility

Without these permissions, the Control Plane logs a warning and falls back to `RunInstances`, so existing locations keep working, but without the EC2 Fleet capacity benefits. `spot = "preferred"` fails, as it requires EC2 Fleet.