ec2-policies.yaml

#
## WARNING AND HISTORICAL NOTE
#
# When the DenyEC2NonNitroInstances policy was first introduced, it was primarily intended
# to ensure that network traffic was encrypted in transit, which was seen to be a feature
# that all Nitro instances supported and all non-Nitro instances did not. However, this
# is not the case, as instance families such as `a1`, `t3`, and `t4g` are Nitro based but
# do not support network traffic encryption in transit.
#
# As such, the DenyEC2NonNitroInstances policy is no longer a reliable way to ensure that
# network traffic is encrypted in transit. It is recommended that you use the
# DenyEC2InstancesWithoutEncryptionInTransit policy (below) instead if that is your goal.

# This policy denies instance families that aren't based on the Nitro system as documented in the following document:
# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances
# The listing below *are* Nitro-based instances. Most are collected from the following CLI query:
#     aws ec2 describe-instance-types \
#        --filters Name=hypervisor,Values=nitro \
#        --query "InstanceTypes[*].[InstanceType]" --output text | cut -f 1 -d. | sort | uniq
#
# However, that the command only lists instance types available in the default region. To be
# fully comprehensive, the command should be run in all regions where instances are launched.
# As a shortcut, we only run the command in us-east-1, us-west-2, and eu-north-1, as these
# regions combined appear to cover all instance types.
#
# In order to fit within the 5120-character limit for policies
# (See https://docs.aws.amazon.com/organizations/latest/userguide/org_troubleshoot_policies.html )
# only the instance family is checked, not the specific instance type. AWS support
# has confirmed that this is in fact correct, and spot checking has failed to
# find any instance families that have some sizes based on Nitro and some not.
#
- sid: "DenyEC2NonNitroInstances"
  effect: "Deny"
  actions:
    - "ec2:RunInstances"
  condition:
    - test: "StringNotLike"
      variable: "ec2:InstanceType"
      values:
        # updated 2024-04-11
        - a1.*
        - c5.*
        - c5a.*
        - c5ad.*
        - c5d.*
        - c5n.*
        - c6a.*
        - c6g.*
        - c6gd.*
        - c6gn.*
        - c6i.*
        - c6id.*
        - c6in.*
        - c7a.*
        - c7g.*
        - c7gd.*
        - c7gn.*
        - c7i.*
        - d3.*
        - d3en.*
        - dl1.*
        - dl2q.*
        - g4ad.*
        - g4dn.*
        - g5.*
        - g5g.*
        - g6.*
        - gr6.*
        - hpc6a.*
        - hpc6id.*
        - hpc7a.*
        - hpc7g.*
        - i3en.*
        - i4g.*
        - i4i.*
        - im4gn.*
        - inf1.*
        - inf2.*
        - is4gen.*
        - m5.*
        - m5a.*
        - m5ad.*
        - m5d.*
        - m5dn.*
        - m5n.*
        - m5zn.*
        - m6a.*
        - m6g.*
        - m6gd.*
        - m6i.*
        - m6id.*
        - m6idn.*
        - m6in.*
        - m7a.*
        - m7g.*
        - m7gd.*
        - m7i.*
        - m7i-flex.*
        - p3dn.*
        - p4d.*
        - p5.*
        - r5.*
        - r5a.*
        - r5ad.*
        - r5b.*
        - r5d.*
        - r5dn.*
        - r5n.*
        - r6a.*
        - r6g.*
        - r6gd.*
        - r6i.*
        - r6id.*
        - r6idn.*
        - r6in.*
        - r7a.*
        - r7g.*
        - r7gd.*
        - r7i.*
        - r7iz.*
        - t3.*
        - t3a.*
        - t4g.*
        - trn1.*
        - trn1n.*
        - u-12tb1.*
        - u-18tb1.*
        - u-24tb1.*
        - u-3tb1.*
        - u-6tb1.*
        - u-9tb1.*
        - vt1.*
        - x2gd.*
        - x2idn.*
        - x2iedn.*
        - x2iezn.*
        - z1d.*

  resources:
    - "arn:aws:ec2:*:*:instance/*"

# This policy denies instance types that do not support Encryption-in-Transit as
# described in the following document:
# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit
# and enumerated by the following command (adapted from the command specified in the documentation):
#
#  aws ec2 describe-instance-types \
#  --filters Name=network-info.encryption-in-transit-supported,Values=true \
#  --query "InstanceTypes[*].[InstanceType]" --output text | cut -f 1 -d. | sort | uniq
#
# Note that the command only lists instance types available in the default region. To be
# fully comprehensive, the command should be run in all regions where instances are launched.
# Since that is difficult, this policy is based on the official AWS documentation instead.
#
# In order to fit within the 5120-character limit for policies
# (See https://docs.aws.amazon.com/organizations/latest/userguide/org_troubleshoot_policies.html )
# only the instance family is checked, not the specific instance type. AWS support
# has confirmed that this is in fact correct, and spot checking has failed to
# find any instance families that have mixed support for encryption in transit based on size.

- sid: "DenyEC2InstancesWithoutEncryptionInTransit"
  effect: "Deny"
  actions:
    - "ec2:RunInstances"
  condition:
    - test: "StringNotLike"
      variable: "ec2:InstanceType"
      values:
        # updated 2024-04-11
        - c5a.*
        - c5ad.*
        - c5n.*
        - c6a.*
        - c6gn.*
        - c6i.*
        - c6id.*
        - c6in.*
        - c7a.*
        - c7g.*
        - c7gd.*
        - c7gn.*
        - c7i.*
        - d3.*
        - d3en.*
        - dl1.*
        - dl2q.*
        - g4ad.*
        - g4dn.*
        - g5.*
        - g6.*
        - gr6.*
        - hpc6a.*
        - hpc6id.*
        - hpc7a.*
        - hpc7g.*
        - i3en.*
        - i4g.*
        - i4i.*
        - im4gn.*
        - inf1.*
        - inf2.*
        - is4gen.*
        - m5dn.*
        - m5n.*
        - m5zn.*
        - m6a.*
        - m6i.*
        - m6id.*
        - m6idn.*
        - m6in.*
        - m7a.*
        - m7g.*
        - m7gd.*
        - m7i.*
        - m7i-flex.*
        - p3dn.*
        - p4d.*
        - p4de.*
        - p5.*
        - r5dn.*
        - r5n.*
        - r6a.*
        - r6i.*
        - r6id.*
        - r6idn.*
        - r6in.*
        - r7a.*
        - r7g.*
        - r7gd.*
        - r7i.*
        - r7iz.*
        - trn1.*
        - trn1n.*
        - u-12tb1.*
        - u-18tb1.*
        - u-24tb1.*
        - u-3tb1.*
        - u-6tb1.*
        - u-9tb1.*
        - vt1.*
        - x2idn.*
        - x2iedn.*
        - x2iezn.*

  resources:
    - "arn:aws:ec2:*:*:instance/*"

- sid: "DenyEC2PublicAMI"
  effect: "Deny"
  actions:
    - "ec2:RunInstances"
  condition:
    - test: "Bool"
      variable: "ec2:Public"
      values:
        - true
  resources:
    - "arn:aws:ec2:*::image/*"

- sid: "DenyEC2AssociatePublicIp"
  effect: "Deny"
  actions:
    - "ec2:RunInstances"
  condition:
    - test: "Bool"
      variable: "ec2:AssociatePublicIpAddress"
      values:
        - true
  resources:
    - "arn:aws:ec2:*:*:network-interface/*"

- sid: "DenyEC2WithNoIMDSv2"
  effect: "Deny"
  actions:
    - "ec2:RunInstances"
  condition:
    - test: "StringNotEquals"
      variable: "ec2:MetadataHttpTokens"
      values:
        - "required"
  resources:
    - "arn:aws:ec2:*:*:instance/*"

- sid: "DenyEC2ApiWithNoMFA"
  effect: "Deny"
  actions:
    - "ec2:StopInstances"
    - "ec2:TerminateInstances"
    - "ec2:SendDiagnosticInterrupt"
  condition:
    - test: "BoolIfExists"
      variable: "aws:MultiFactorAuthPresent"
      values:
        - false
  resources:
    - "*"

- sid: "RequireEBSEncryption"
  effect: "Deny"
  actions:
    - "ec2:CreateVolume"
  condition:
    - test: "Bool"
      variable: "ec2:Encrypted"
      values:
        - false
  resources:
    - "*"