About that AmazonEC2FullAccess requirement

[jfsmith-at-coveo]

I was wondering how you would justify such a far-ranging authorization policy. In the code I only see ec2.describeInstances() and ec2.terminateInstances() being used. From what I can see, if I give those two -- and only those -- to my Lambda, it will work. So why would you say that full access is required?