I'm trying to set up an IAM policy that allows a user to run an instance (ec2:RunInstances), but only from a specific launch template - and without making any changes to that launch template's parameters.
The relevant section of my policy looks like this:
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "*",
"Condition": {
"ArnLike": {
"ec2:LaunchTemplate": "arn:aws:ec2:ap-southeast-2:xxxxxxx:launch-template/lt-xxxxxxx"
},
}
}
This works great. Running the following using the user's credentials works:
aws ec2 run-instances --launch-template LaunchTemplateName=test
...and specifying a different launch template fails. So far so good.
However, the user can override values in the launch template, and pretty much do whatever they like:
aws ec2 run-instances --launch-template LaunchTemplateName=test --instance-type t2.micro
This is despite me setting the instance type in the launch template as t2.nano.
The documentation has a solution for this: require the ec2:IsLaunchTemplateResource condition to be "true", which apparently only is so if the user has not overridden the launch template.
Perfect - exactly what I was after! The Condition statement in my IAM policy now looks like this:
"Condition": {
"ArnLike": {
"ec2:LaunchTemplate": "arn:aws:ec2:ap-southeast-2:xxxxxxx:launch-template/lt-xxxxxxx"
},
"Bool": {
"ec2:IsLaunchTemplateResource": "true"
}
}
However, with this additional condition present, the RunInstances call fails even if the user makes no changes. After decoding the authorization failure message, I can see that AWS is reporting ec2:IsLaunchTemplateResource was not "true":
{
"key": "ec2:IsLaunchTemplateResource",
"values": {
"items": [
{
"value": "false"
}
]
}
}
EDIT: After posting this, I continued to iterate, and noticed that the specific resource that was hitting up against this issue was the subnet - which wasn't defined in the launch template. Taking cues from additional examples in the documentation I linked to, I tried adding another statement to allow the subnet resource even without ec2:IsLaunchTemplateResource being true, and this worked. I also tried, alternatively, explicitly defining the subnet in the launch template: this worked too.
However, now I am not getting access denied even when changing the instance type! So it appears that it was the subnet all along that was triggering the original denial. While I've sort of taken a step forward, the symptom of the issue has now flipped from what I was initially experiencing... and now although the user can launch, they can also launch instances I don't want them to. So my initial question below still remains. :)
So, my question is... have I done something wrong? Does ec2:IsLaunchTemplateResource work in the way I have understood it (which I think is fairly clear in the documentation)?
Alternatively, is there another way I could allow an IAM user to launch an instance in line with a template, while preventing them from making changes (such as choosing a super-expensive instance type)?
