Create an IAM Policy to restrict service usage by region

To manage costs you need to manage and control your usage. AWS offers multiple regions, so depending on your business requirements you can limit access to AWS services depending on the region. This can be used to ensure usage is only allowed in specific regions which are more cost effective, and minimize associated usage and cost, such as data transfer.

We will create a policy that allows all EC2, RDS and S3 access in a single region only. NOTE: it is best practice to provide only the minimum access required, the policy used here is for brevity and simplicity, and should only be implemented as a demonstration before being removed.

Create the Region restrictive IAM Policy

1. Go to the IAM service page:

2. Select Policies from the left menu:

3. Click Create Policy:

4. Click the JSON tab:

5. Copy and paste the policy into the console:

   IAM Policy

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:*",
                   "rds:*",
                   "s3:*"
               ],
               "Resource": "*",
       "Condition": {"StringEquals": {"aws:RequestedRegion": "us-east-1"}}
           }
       ]
   }
   

6. Click Review policy:

7. Create the policy with the following details:

   • Name: RegionRestrict
   • Description: EC2, RDS, S3 access in us-east-1 only
   • Click Create policy:

Apply the policy to your test group

1. Select Groups from the left menu:

2. Click on the CostTest group (created previously):

3. Select the Permissions tab:

4. Click Attach Policy:

5. Click Policy Type and select Customer Managed:

6. Select the checkbox next to Region_Restrict (created above) and click Attach Policy:

Verify the policy is in effect

1. Logon to the console as the TestUser1 user, go to the EC2 Service dashboard:

2. Click the current region in the top right, and select US West (N.California):

3. Try to launch an instance by clicking Launch Instance, select Launch Instance:

4. Click on Select next to the Amazon Linux 2 AMI, You will receive an error when you select an AMI as you do not have permissions:

You have successfully verified that you cannot launch any instances outside of the N.Virginia region. We will now verify we have access in us-east-1 (N.Virginia):

5. Change the region by clicking the current region, and selecting US East (N.Virginia):

6. Now attempt to launch an instance, choose the Amazon Linux 2 AMI, leave 64-bit (x86) selected, click Select:

7. Scroll down and select a c5.large, and click Review and Launch:

8. Take note of the security group created (as you need to delete it), Click Launch:

9. Select Proceed without a key pair, and click I acknowledge.. checkbox, and click Launch Instances:

10. You will get a success message, click on the instance id:

11. Ensure the correct instance is selected, click Actions, then Instance State, then Terminate:

12. Confirm the instance ID is correct, click Yes, Terminate:

13. Log out of the console as TestUser1.