AWS培训环境如何限制高端EC2及高成本资源创建？求IAM方案建议

Great question—this is such a common challenge in student training environments where you need to balance hands-on learning with cost control. Let’s walk through actionable IAM policies and strategies to lock down high-cost resources and prevent unauthorized actions.

1. Block High-Spec EC2 Instance Types #

The most straightforward way to cut EC2 costs is to deny access to large, expensive instance families (like m5.24xlarge, r5.12xlarge, p3.8xlarge). You can create a policy that explicitly rejects these types while allowing smaller, training-friendly ones (like t2.micro, t3.small, t4g.nano).

Here’s a sample policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:*:*:instance/*",
            "Condition": {
                "ForAnyValue:StringLike": {
                    "ec2:InstanceType": [
                        "*.8xlarge", "*.12xlarge", "*.16xlarge", "*.24xlarge",
                        "p*.*", "g*.*", "x*.*"
                    ]
                }
            }
        }
    ]
}

Note: Adjust the instance type patterns to match which high-cost types you want to block. You can also use StringNotLike to allow only specific small types if that’s safer.

2. Restrict Other High-Cost Services #

Don’t stop at EC2—extend these limits to other pricey resources:

• EBS Volumes: Block high-IOPS volumes (io2/io1) and limit maximum volume size:

  {
      "Effect": "Deny",
      "Action": "ec2:CreateVolume",
      "Resource": "*",
      "Condition": {
          "StringEquals": {"ec2:VolumeType": ["io1", "io2"]},
          "NumericGreaterThan": {"ec2:VolumeSize": 50}
      }
  }
  

• RDS: Deny large database instances or prohibit publicly accessible databases:

  {
      "Effect": "Deny",
      "Action": "rds:CreateDBInstance",
      "Resource": "*",
      "Condition": {
          "ForAnyValue:StringLike": {
              "rds:DBInstanceClass": ["*.8xlarge", "*.12xlarge"]
          },
          "Bool": {"rds:PubliclyAccessible": true}
      }
  }
  

3. Prevent Unauthorized Resource Modification/Deletion #

To avoid accidental or intentional cost spikes from resource changes, limit destructive actions:

• Deny terminating EC2 instances or deleting critical resources:

  {
      "Effect": "Deny",
      "Action": [
          "ec2:TerminateInstances",
          "s3:DeleteBucket",
          "rds:DeleteDBInstance"
      ],
      "Resource": "*"
  }
  

• Alternatively, restrict modifications to only resources tagged with your training project (enforce tagging first—see next section):

  {
      "Effect": "Allow",
      "Action": ["ec2:StopInstances", "ec2:StartInstances"],
      "Resource": "*",
      "Condition": {
          "StringEquals": {"aws:ResourceTag/Project": "StudentTraining"}
      }
  }
  

4. Enforce Mandatory Tagging #

Tagging is critical for cost tracking and policy enforcement. Create a policy that requires students to tag every resource they create (e.g., Owner=StudentName, Project=Training):

{
    "Effect": "Deny",
    "Action": [
        "ec2:RunInstances",
        "s3:CreateBucket",
        "rds:CreateDBInstance"
    ],
    "Resource": "*",
    "Condition": {
        "Null": {
            "aws:RequestTag/Owner": true,
            "aws:RequestTag/Project": true
        }
    }
}

• Use IAM Roles Instead of Access Keys: Assign students temporary credentials via AWS IAM Identity Center (formerly SSO) instead of long-term access keys. This reduces the risk of credential leaks and unauthorized access.
• Leverage AWS Organizations SCPs: If you’re using multiple AWS accounts for training, use Service Control Policies (SCPs) at the organization level to enforce these restrictions across all student accounts—this is more scalable than per-account policies.
• Set Up Budget Alerts: Use AWS Budgets to get notified if costs exceed your threshold. This lets you catch unexpected spending early.
• AWS Config for Compliance: Configure AWS Config rules to detect and alert when a student creates a restricted resource (e.g., a high-spec EC2 instance).

内容的提问来源于stack exchange，提问作者Ganesh A