AWS SCP for EC2 type

user_1884473 0
Viewed 462

I want to allow users only to create t2.micro/small/medium for development and allow them to use only spot instances. Have created IAM policy to restrict type/size of instances. In addition I want to put restriction on "on-demand" instances (team MUST opt for spot instances only). What is the cleaner way of achieving it?

aws-policies amazon-web-services amazon-ec2
3 Answers

Try AWS Service Catalog.. that is the exact service which can help u here.

user_13124780

Use the ec2:InstanceMarketType condition key in your IAM policy.

Example (untested):

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "ec2:InstanceMarketType": "spot"
            }
        }
    }
}

References:

user_8563730

allow full access with the account

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "limitedSize",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "cloudwatch:DescribeAlarms"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*"
      ],
      "Condition": {
        "ForAnyValue:StringNotLike": {
          "ec2:InstanceType": [
            "t3.*",
            "t2.*"
          ]
        }
      }
    }
  ]
}
user_155911800
Related