How to restrict the instance_types allowed to launch in an AWS Account?

user_6373164 0
Viewed 332

The goal is to restrict future EC2 instances to only types with nitro as the hypervisor (i.e. run_instances, modify_instance_attributes). Ideally at the Service Control Policy (SCP) level in AWS Organizations.

I have written a script to gather a list of all nitro instance types and presently that is 225 instance types or 31 generations (e.g. i3en, m5n, c5d, etc). That's not exactly elegant.

What I have imagined in my head is something like:

"Condition": {
    "StringEquals": {
        "ec2:InstanceType/Hypervisor": "nitro"
    }
}

But the only thing I know to work looks akin to the following (with all 2

"Condition": {
   "StringEquals": {
      "ec2:InstanceType": ["t2.micro", "t2.small"]
   }
}

Regardless whether there is a good solution, thanks for taking the time to read this. Cheers.

amazon-iam amazon-web-services amazon-ec2
1 Answers

I think the simplest solution for an SCP is to use a Deny rule with StringNotLike, which can use wildcards:

"Effect": "Deny",
"Action": [
    "ec2:RunInstances"
],
"Resource": [
    "arn:aws:ec2:*:*:instance/*"
],
"Condition": {
    "StringNotLike": {
        "ec2:InstanceType": [
            "t2.*",
            "t3.*"
        ]
    }
}

This is still, perhaps, more typing that you'd like, but in my experience you want to limit instance types more than just those that use a particular hypervisor. For example, to restrict instances by their hourly cost. This ends up being a relatively small set of strings.

user_134007290
Related