## Grant ec2:DescribeSubnets to AWS Private Locations

**Who is affected:** users with AWS Private Locations who manage the Control Plane IAM policy themselves.

### What Changed

The Control Plane reads the free IP addresses of your subnets to deploy load generators in the subnets with the most room.

### Migration Guide

Add `ec2:DescribeSubnets` to the statement of your `GatlingControlPlaneEc2Policy` that allows `ec2:DescribeInstances`:

```json
{
    "Effect": "Allow",
    "Action": [
        "ec2:DescribeImages",
        "ec2:DescribeInstances",
        "ec2:DescribeSubnets"
    ],
    "Resource": "*"
}
```

See the [full policy]({{< ref "/reference/deploy/private-locations/aws/installation/#policies" >}}).

### Backward Compatibility

The permission is optional. Without it, subnets are tried in random order and the Control Plane logs a `'ec2:DescribeSubnets' not authorized` warning.