4

I'm trying to set up an IAM policy that allows a user to run an instance (ec2:RunInstances), but only from a specific launch template - and without making any changes to that launch template's parameters.

The relevant section of my policy looks like this:

{
  "Effect": "Allow",
  "Action": "ec2:RunInstances",
  "Resource": "*",
  "Condition": {
    "ArnLike": {
      "ec2:LaunchTemplate": "arn:aws:ec2:ap-southeast-2:xxxxxxx:launch-template/lt-xxxxxxx"
    },
  }
}

This works great. Running the following using the user's credentials works:

aws ec2 run-instances --launch-template LaunchTemplateName=test

...and specifying a different launch template fails. So far so good.

However, the user can override values in the launch template, and pretty much do whatever they like:

aws ec2 run-instances --launch-template LaunchTemplateName=test --instance-type t2.micro

This is despite me setting the instance type in the launch template as t2.nano.

The documentation has a solution for this: require the ec2:IsLaunchTemplateResource condition to be "true", which apparently only is so if the user has not overridden the launch template.

Perfect - exactly what I was after! The Condition statement in my IAM policy now looks like this:

  "Condition": {
    "ArnLike": {
      "ec2:LaunchTemplate": "arn:aws:ec2:ap-southeast-2:xxxxxxx:launch-template/lt-xxxxxxx"
    },
    "Bool": {
      "ec2:IsLaunchTemplateResource": "true"
    }
  }

However, with this additional condition present, the RunInstances call fails even if the user makes no changes. After decoding the authorization failure message, I can see that AWS is reporting ec2:IsLaunchTemplateResource was not "true":

{
  "key": "ec2:IsLaunchTemplateResource",
  "values": {
    "items": [
      {
        "value": "false"
      }
    ]
  }
}

EDIT: After posting this, I continued to iterate, and noticed that the specific resource that was hitting up against this issue was the subnet - which wasn't defined in the launch template. Taking cues from additional examples in the documentation I linked to, I tried adding another statement to allow the subnet resource even without ec2:IsLaunchTemplateResource being true, and this worked. I also tried, alternatively, explicitly defining the subnet in the launch template: this worked too.

However, now I am not getting access denied even when changing the instance type! So it appears that it was the subnet all along that was triggering the original denial. While I've sort of taken a step forward, the symptom of the issue has now flipped from what I was initially experiencing... and now although the user can launch, they can also launch instances I don't want them to. So my initial question below still remains. :)


So, my question is... have I done something wrong? Does ec2:IsLaunchTemplateResource work in the way I have understood it (which I think is fairly clear in the documentation)?

Alternatively, is there another way I could allow an IAM user to launch an instance in line with a template, while preventing them from making changes (such as choosing a super-expensive instance type)?

  • 1
    This mostly sounds like a bug on AWS side, did you open a case at AWS also ? They'd be far more authoritative than us to answer that. – Tensibai Jun 29 '18 at 7:45
  • I guess that is possible... I generally assume that issues like this are not bugs (because I'm sure AWS would have a massively decent amount of testing), but rather me misunderstanding how it works :P Having said that, I've iterated on this and am just about to edit my question with additional findings. – Tim Malone Jun 29 '18 at 8:17
  • On another note, I know I could add the instance type to the IAM policy as well. I guess this will be the fallback solution, but I'd much rather not be maintaining the launch template parameters in two places - particularly because I'll probably need to add more checks, eg. for the image ID as well, and also because the documentation does seem to imply that this doesn't have to be done. :/ – Tim Malone Jun 29 '18 at 8:32
  • I am little bit lost in how the current IAM permissions for the executing user look like. Can you maybe create a test user with ONLY relevant permissions & test & share the full policy? For maintaining the conditions on two places CloudFormation template can be a good help - with parameters you can still have the definition at one place. – Petr Chloupek Apr 22 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.