How to Restrict EC2 Instance Launches After Office Hours for All Users, Including Admins

Question

I am looking to enforce a time-based restriction for launching EC2 instances in my AWS environment. Specifically, I want to ensure that EC2 instances can only be launched during office hours from 9 AM to 6 PM IST daily.

I need this restriction to apply to all users, including those with full AdministratorAccess. I have attempted to use IAM policies with the aws:RequestTime condition, but I want to confirm the best approach to universally enforce this policy, particularly for users with administrative privileges.

Could you please advise on:

The most effective way to restrict EC2 instance launches outside of office hours?
How to ensure that this restriction applies to all users, regardless of their permission level?
Any potential challenges or best practices for implementing this policy?
Thank you in advance for your assistance.

Didier Durand · Answer

Hi,

You can try to achieve your goal with time-based conditions in the policies where you allow to start EC2 instances.

See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws-dates.html for samples.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "service-prefix:action-name",
            "Resource": "*",
            "Condition": {
                "DateGreaterThan": {"aws:CurrentTime": "2020-04-01T00:00:00Z"},
                "DateLessThan": {"aws:CurrentTime": "2020-06-30T23:59:59Z"}
            }
        }
    ]
}
```

Best,

Didier

How to Restrict EC2 Instance Launches After Office Hours for All Users, Including Admins

Add your answer

Relevant content