How to limit EC2 EBS volume size for ec2:RunInstances in IAM policy?

问题

The IAM policy I have now is able to limit the instance type, but I want to also be able to limit the EBS volume size to below a certain value. How would I modify the following JSON IAM policy? Preferably I'd want something along the lines of a "Condition": "IntegerLessThanOrEquals", but manually specifying each number is acceptable, as I need to limit it to 10 GiB.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AdminPermissions",
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand",
                "ssm:GetCommandInvocation",
                "ec2:StopInstances",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeNetworkInterfaces",
                "ec2:CreateTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "RunInstanceResourcePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*::image/*"
            ]
        },
        {
            "Sid": "LimitInstanceTypes",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceType": [
                        "t2.nano",
                        "t2.micro",
                        "t2.small",
                        "t2.medium"
                    ]
                }
            }
        }
    ]
}

Edit: Answer

This is the solution I got. The Statement "LimitInstanceVolumeSize" is the new one, and the resource "arn:aws:ec2:::volume/*" was moved to it.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AdminPermissions",
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand",
                "ssm:GetCommandInvocation",
                "ec2:StopInstances",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeNetworkInterfaces",
                "ec2:CreateTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "RunInstanceResourcePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*::image/*"
            ]
        },
        {
            "Sid": "LimitInstanceVolumeSize",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "NumericLessThanEquals": {
                    "ec2:VolumeSize": "16"
                }
            }
        },
        {
            "Sid": "LimitInstanceTypes",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceType": [
                        "t2.nano",
                        "t2.micro",
                        "t2.small",
                        "t2.medium"
                    ]
                }
            }
        }
    ]
}

回答1:

You can achieve this by using Condition key ec2:VolumeSize the resource would be arn:aws:ec2:region:account:volume/* and API Action would be AttachVolume.

Thanks

来源：https://stackoverflow.com/questions/49104681/how-to-limit-ec2-ebs-volume-size-for-ec2runinstances-in-iam-policy