Limited EC2 usage by Instance Family

Limit EC2 usage by Instance Family

create vpc for linux instance

  • AWS provides different instance families in EC2. Depending on your workload requirements - different families will be most cost effective. For environments like dev/test, you can limit instance families in that account to type General Purpose - cost-optimized.
  • We will create a policy that only allows operations to be performed on a few specific instance families. This not only limits the launch of an EC2 instance but also limits all other operations on the remaining services.
    • Noted: instance family is instance family representing criteria such as:
      1. C – Compute optimized
      2. R – Memory optimized
      3. M – General purpose

  1. Compute requirements

    • Suppose, as a Cloud engineer, you receive a request from the Dev team: need virtual machines that meet the following criteria:
      1. Appropriate configuration to run for development environments
      2. Can run CPU architecture: x86 and Arm
      3. Run for small and medium databases
      4. Virtual machines can be used as code repositories solutions
      5. Because in the development phase, the usage needs are only General Purpose

  2. Select Compute

    • You need to go to AWS’s EC2 page to check which Instance Families meet the above criteria

    • In the PAGE CONTENT section you will see EC2 divided into groups with different uses, select General Purpose

    create vpc for linux instance

    • Select the instance family and check:

      1. Features to get an overview of the chip, performance,…
      2. Use Cases to understand in more detail the purposes of use,…

      create vpc for linux instance

    • With the above criteria, there are many suitable instance families, but within the framework of this lab, we will choose: T3, T4g, M5 because:

      1. Development environments : T3, T4g
      2. CPU Architecture
        • x86: T3, M5
        • Arm: T4g
      3. Small and medium databases : M5, T3
      4. Code repositories: T3, T4g
      5. General Purpose: T3, T4g, M5

  3. Create an IAM Policy that only allows users to initialize EC2 with instance family: T3, T4g, M5

    • In the AWS console, in the search box, enter IAM
    • Select IAM service

    create vpc for linux instance

    • On the left side of the screen, select Policies
    • Select Create policy

    create vpc for linux instance

    • Create policy in JSON data format instead of Visual. Select JSON

    create vpc for linux instance

    • Scan the entire current code and press the Delete button

    create vpc for linux instance

    • Copy the following code into the Policy editor box, Scroll down and select Next
      • Meaning: User has the right to create EC2 with instance family: T3, T4g, M5
    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:*:148922931563:instance/*",
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                        "t3.*",
                        "t4g.*",
                        "m5.*"
                    ]
                }
            }
        }
    ]
}
    • Noted: in the Resource line, replace the 12-digit sequence with your AWS account ID. Select the triangle symbol, then select the square symbol to copy the AWS account ID

    create vpc for linux instance

    create vpc for linux instance

    • In the Policy name section, enter: EC2_FamilyRestrict
    • In the Description section, enter: Restrict to all, except t3, t4g and m5 families
    • Scroll to the bottom of the page and select Create policyy

    create vpc for linux instance

  4. Add policy EC2_FamilyRestrict to group CostTest

    • At IAM Console, left section - select User groups
    • Select CostTest

    create vpc for linux instance

    • Select Permissions

    create vpc for linux instance

    • Select Add permissions, select Attach policies

    create vpc for linux instance

    • In the search box 🔍, enter EC2_FamilyRestrict.
    • Check the box symbol □ to select a policy, select Attach policies

    create vpc for linux instance

    • Check Permissions policies
      • Now in the CostTest group there is policy EC2_FamilyRestrict and policy RegionRestrict that you created in lab 8.1

    create vpc for linux instance

    • Remove policy RegionRestrict because of least-privilege permissions criteria
      • Check the box symbol □ to select the policy, select Remove

    create vpc for linux instance

    • Check User’s policy

      • Select Users
      • Select TestUser

      create vpc for linux instance

      • At this time, at IAM User: TestUser, in the Policy Name section you see the appearance of policy EC2_FamilyRestrict
      • In the section Attached via - Group CostTest, it means that these policies are assigned to the User through the group, not directly to the User.
      • -> This satisfies AWS’s best practice of centralized permission management through Group

      create vpc for linux instance

  5. Check Permissions policies for Instance family: T4g

    • Log in to TestUser with the information you created in lab 8.1, step 4
    • Make sure you are in Region Singapore
    • In the search box 🔍, enter EC2

    create vpc for linux instance

    • At the EC2 interface, in the middle of the page, select Launch instance

    create vpc for linux instance

    • In the Name section, enter EC2_T4g_FamilyRestrict

    create vpc for linux instance

    • In the Architecture section, select the triangle symbol, select 64-bit(Arm)

    create vpc for linux instance

    • In the Instance type section, select the triangle symbol, select t4g.micro

    create vpc for linux instance

    • In the key pair name section, select the triangle symbol, select Proceed without a key pair (Not recommended)
    • Select Launch instance

    create vpc for linux instance

    • Select Instance ID that has just been successfully created

    create vpc for linux instance

    • Congratulations, you have successfully created EC2 with instance family T4g

    create vpc for linux instance

  6. Check Permissions policies for Instance family: M6i

    • Select Launch instance

    create vpc for linux instance

    • In the Name section, enter EC2_M6i_FamilyRestrict

    create vpc for linux instance

    • In the Architecture section, keep the value 64-bit(x86)
    • In the Instance type section, select the triangle symbol, select m6i.large

    create vpc for linux instance

    • In the key pair name section, select the triangle symbol, select Proceed without a key pair (Not recommended)
    • Select Launch instance

    create vpc for linux instance

    • You received the response Instance launch failed - because you are not authorized. This satisfies the permission policy: EC2_FamilyRestrict that you created in step 3.

    create vpc for linux instance

  7. You can proceed to step 5 again, creating EC2 with instance family T3 and M5 to test the effectiveness of permission policy: EC2_FamilyRestrict