Overview: Users will be logging into windows EC2 instance directly from their source ip and the source ip tends to change often.
Current State: We have provided IAM users access to modify/create/delete security groups.
Need: Users have an option to add wide open security group rules, which expose unnecessary vulnerabilities. Is there a way to restrict users adding wide open inbound access(0.0.0.0) to security group rules/restrict them to add only their source ip to the inbound access rule of the security group?
My initial Findings: I checked the IAM docs, I didn't find any way to achieve this. Is there any better workaround to achieve this rather than getting alert/notification after they have added a wide open security group rule?