I'm trying to figure out how to restrict users to only be able to launch instances using a specific launch template. Here is my current policy so far:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "*",
"Condition": {
"StringLikeIfExists": {
"ec2:InstanceType": "t2.micro"
},
"ArnEquals": {
"ec2:LaunchTemplate": ""
}
}
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeAddresses",
"ec2:GetEbsEncryptionByDefault",
"ec2:DescribeVolumesModifications",
"ec2:DescribeSnapshots",
"kms:DescribeCustomKeyStores",
"ec2:DescribeInstanceTypeOfferings",
"ec2:StartInstances",
"ec2:DescribeAvailabilityZones",
"ec2:CreateSnapshot",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:DescribeKeyPairs",
"ec2:DescribeInstanceStatus",
"ec2:TerminateInstances",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeTags",
"ec2:CreateTags",
"ec2:DescribeLaunchTemplateVersions",
"ec2:AssignPrivateIpAddresses",
"ec2:StopInstances",
"ec2:DescribeSecurityGroups",
"ec2:CreateVolume",
"ec2:DescribeImages",
"kms:ListKeys",
"ec2:CreateSnapshots",
"ec2:DescribeVpcs",
"kms:ListAliases",
"ec2:DescribeInstanceTypes",
"ec2:DescribeSubnets"
],
"Resource": "*"
}
]
}
I am trying to use the condition "ArnEquals": {"ec2:LaunchTemplate": "" but I don't believe launch templates have an ARN. I tried using the launch template ID but that did not work. Any help would be appreciated!