Possible to Deny ec2:RunInstances Condition ForAnyValue:StringLike u*.*

0

Hello,
I'm trying to create a IAM policy based off of the guide below:
https://aws.amazon.com/premiumsupport/knowledge-center/restrict-launch-tagged-ami/

But rather than restricting by tag, I want to deny the more costly instance types. I've seen some docs that say the ".metal" should work, but I'm having trouble with it. Also, is it possible to deny entire instance types via something like "u.*" as a condition? I'd like to keep the list short rather than having to maintain a large list if possible.

Example deny statement below:

"Statement" : \[  
  {  
    "Sid" : "LaunchEC2withLimitedTypes",  
    "Effect" : "Deny",  
    "Action" : \[  
      "ec2:RunInstances",  
      "ec2:ModifyInstanceAttribute",  
    ],  
    "Resource" : "arn:aws:ec2:us-east-1::image/ami-*",  
    "Condition" : {  
      "ForAnyValue:StringLike" : {  
        "ec2:InstanceType" : \[  
          "*.metal",  
          "u**.**",  
          "p**.**",  
          "i**.**",  
          "x**.**"  
        ]  
      }  
    }  
  }
preguntada hace 3 años291 visualizaciones
1 Respuesta
1

changing resource from arn:aws:ec2:us-east-1::image/ami-** to arn:aws:ec2:::instance/** resolved the issue.

respondido hace 3 años

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas