Skip to content

Instantly share code, notes, and snippets.

@onema

onema/lock-down-access-to-instance-types.yml

Created January 24, 2017 21:43
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save onema/79906942ce771644ded20b07a8990ae2 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save onema/79906942ce771644ded20b07a8990ae2 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. onema created this gist Jan 24, 2017.
    43 changes: 43 additions & 0 deletions lock-down-access-to-instance-types.yml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,43 @@
    AWSTemplateFormatVersion: "2010-09-09"

    Description: >
    Tempalte to create a managed policy to lock down users to create instance of a specific type
    Parameters:
    InstanceTypes:
    Description: >
    Comma separated list of instance types that will be allowed by the policy
    e.g. "t1.*, t2.*, m3.*"
    Type: "CommaDelimitedList"
    Default: "t1.*, t2.*, m3.*"

    Resources:
    LockDownAccessToInstanceTypesPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
    Description: "Policy to enable users to manage specific instance types"
    Path: "/"
    PolicyDocument:
    Version: "2012-10-17"
    Statement:
    -
    Effect: "Allow"
    Action:
    - "ec2:*"
    Resource: "*"
    -
    # Deny access if the instance types are not the ones described below
    Effect: "Deny"
    Action: "ec2:RunInstances"
    Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
    Condition:
    StringNotLikeIfExists:
    # Only apply this condition if this intance type key exists
    ec2:InstanceType: !Ref InstanceTypes

    Outputs:
    LockDownAccessToInstanceTypesPolicy:
    Description: Policy to enable users to manage specific instance types
    Value: !Ref LockDownAccessToInstanceTypesPolicy
    Export:
    Name: !Sub "${AWS::StackName}-LockDownAccessToInstanceTypesPolicy"