I'm looking for a way to restrict the visibility ec2 instances to certain IAM accounts. I'd really like a way for a particular account to only be able to see the instances that it has created i.e. when it does a describeInstances only those it has created are present.
I've been looking into using custom IAM policies based on resource tags to do this and while the management looks to be ok, each account can still see instances created by other users using describeInstances.
Really I'm looking for a way to hide resources created by different IAM accounts from one another. Is this currently possible?