Create an IAM policy to restrict EBS Volume creation by volume type

Extending cost optimization governance beyond compute instances will ensure overall higher levels of cost optimization. Similar to EC2 instances, there are different storage types. Governing the type of storage that can be created in an account can be effective to minimize cost.

We will create an IAM policy that denies operations that contain provisioned IOPS (io1) EBS volume types. This will not only restrict creating a volume, but all other actions that attempt to use this volume type.

Create the EBS type restrictive IAM Policy

1. Log on to the console as your regular user with the required permissions, go to the IAM service page:

2. Click on Policies on the left menu:

3. Click Create policy:

4. Click on the JSON tab:

5. Copy and paste the policy into the console:

   IAM Policy

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Deny",
               "Action": "ec2:*",
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "ec2:VolumeType": "io1"
                   }
               }
           }
       ]
   }
   

6. Click on Review Policy:

7. Configure the following details:

   • Name: EC2EBS_Restrict
   • Description: Dont allow EBS io1 volumes
   • Click Create policy:

Apply the policy to your test group

1. Click on Groups from the left menu:

2. Click on the CostTest group:

3. Click on Attach Policy:

4. Click on Policy Type, then click Customer Managed:

5. Select the checkbox next to EC2EBS_Restrict, and click Attach Policy:

Verify the policy is in effect

1. Logon to the console as the TestUser1 user, click on Services then click EC2:

2. Try to launch an instance by clicking Launch Instance, select Launch Instance:

3. Click Select next to Amazon Linux 2…:

4. Select t3.nano (which is allowed as per our already applied policy, which we tested in the last exercise), click Next: Configure Instance Details:

5. Click Next Add Storage:

6. Click on Add New Volume, click on the dropdown, then select Provisioned IOPS SSD (io1):

7. Click Review and Launch:

8. Take note of the security group created, and click Launch:

9. Select Proceed without a key pair, and click I acknowledge that i will not be able to…, then click Launch Instances:

10. The launch will fail, as it contained an io1 volume. Click Back to Review Screen:

11. Scroll down and click Edit storage:

12. Click the dropdown and change it to General Purpose SSD(gp2), click Review and Launch:

13. Click Launch:

14. Select Proceed without a key pair, and click I acknowledge that i will not be able to…, then click Launch Instances:

15. It will now succeed, as it doesn’t contain an io1 volume type. Click on the instance ID and terminate the instance as above:

16. Log out of the console as TestUser1.