How can I force a user to use a specific launch template when creating instances?

Viewed 21

I'm trying to figure out how to restrict users to only be able to launch instances using a specific launch template. Here is my current policy so far:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": "*",
            "Condition": {
                "StringLikeIfExists": {
                    "ec2:InstanceType": "t2.micro"
                },
                "ArnEquals": {
                    "ec2:LaunchTemplate": ""
                }
            }
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeAddresses",
                "ec2:GetEbsEncryptionByDefault",
                "ec2:DescribeVolumesModifications",
                "ec2:DescribeSnapshots",
                "kms:DescribeCustomKeyStores",
                "ec2:DescribeInstanceTypeOfferings",
                "ec2:StartInstances",
                "ec2:DescribeAvailabilityZones",
                "ec2:CreateSnapshot",
                "ec2:GetEbsDefaultKmsKeyId",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeInstanceStatus",
                "ec2:TerminateInstances",
                "ec2:DescribeLaunchTemplates",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:AssignPrivateIpAddresses",
                "ec2:StopInstances",
                "ec2:DescribeSecurityGroups",
                "ec2:CreateVolume",
                "ec2:DescribeImages",
                "kms:ListKeys",
                "ec2:CreateSnapshots",
                "ec2:DescribeVpcs",
                "kms:ListAliases",
                "ec2:DescribeInstanceTypes",
                "ec2:DescribeSubnets"
            ],
            "Resource": "*"
        }
    ]
}

I am trying to use the condition "ArnEquals": {"ec2:LaunchTemplate": "" but I don't believe launch templates have an ARN. I tried using the launch template ID but that did not work. Any help would be appreciated!

0 Answers
Related