24

We run a number of AWS services in the eu-west-1 region. Unfortunately it seems that a lot of our developers and other employees who need to create temporary resources forget about this aspect of AWS and don't select this region before launching EC2 instances, creating S3 buckets, etc. As a result they often end up in the us-east-1 region since that appears to be the default that AWS always uses.

Is there any way through IAM (or some other way) to restrict user accounts to only launch/create things within a specific region?

25

Unfortunately you can't do this globally. However, for each AWS product that supports it, you typically can limit access to a certain region.

For instance, for EC2, you can do the following:

{
  "Statement":[{
    "Effect":"allow",
    "Action":"RunInstances",
    "Resource":"*",
    "Condition":{
      "StringEquals":{
        "ec2:Region":"us-west-1"
        }
      }
    }
  ]
}

Of course, you'd need to issue a deny rule as well where appropriate.

Here's the documentation for the above.

|improve this answer|||||
  • Perfect. This looks like exactly what I need. Thanks! – Bruce P Apr 15 '14 at 18:05
  • 5
    Instead of "Condition": { "condition": {} } it should state "Condition": { "StringEquals": {} } – Arnold Daniels Aug 6 '15 at 12:49
  • What about other services like S3? – Yves M. Feb 12 '18 at 15:48
9

Use something like this. This example restricts access to two AWS regions. Modify as needed.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "aws:RequestedRegion": [
          "eu-central-1",
          "eu-west-1"
        ]
      }
    }
  }]
}
|improve this answer|||||
  • 3
    WIth the new aws:RequestedRegion, this is the answer that is now most relevant – majikman Sep 8 '18 at 21:23
  • 1
    Thank you, with this policy you can use the default AWS available policies and only attach this one inline and you effectively restrict any services. – lkraider Feb 5 '19 at 23:23
8

Since April 25th 2018, AWS has a global resource aws:RequestedRegion you can use to limit the regions a user can send requests to. This is independent of the service being regional or not, so you can apply it to all services.

AWS Security Blog

Unfortunately you can't use this in an organization's Service Control Policy to apply it to an account globally, and you must attach the policy to every single principal and audit that this is so, if you want to lock an account to certain regions.

|improve this answer|||||
4

Accepted answer on this thread gave Syntax Error on Policy. Below worked for me:

{
"Statement": [
    {
        "Sid": "Stmt1375943389569",
        "Action": "ec2:*",
        "Effect": "Allow",
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "ec2:Region": "eu-central-1"
            }
        }
    }
]

}

|improve this answer|||||
3

If you ask only for EC2 actions, then yes, you can limit it as mentioned in other responses. If it's other services, I am not sure you can do it... e.g. AWS Lambda does not seem to have a lambda:region you can add to a condition.

|improve this answer|||||
0

From the FAQ for AWS IAM:

Q: Can users be defined regionally? Not initially. Users are global entities, like an AWS Account is today. No region is required to be specified when defining user permissions. users are able to use AWS services in any geographic region.

|improve this answer|||||
  • 3
    Wow. What a poorly written answer from Amazon. "Not initially." Does that imply that it can be done after the account is created? Does that mean AWS couldn't when it was first launched but it can now? "No region is required to be specified when defining user permissions." I didn't ask if it was required. I asked if it was possible to do so. "users are able to use AWS services in any geographic region." Apparently not any more based on what EEAA posted above. The "condition" statement in IAM lets you restrict some services by region. Thanks just the same. – Bruce P Apr 15 '14 at 18:05
  • 1
    @BruceP - it's not a poor answer. It's perfectly fine. Users are global. User privileges can be restricted. – EEAA Apr 16 '14 at 0:06
0

I found this to work better (allows launching/stopping/terminating/etc.) to grant full EC2 access for a user to only one region - every other region shows error during any attempted access.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "*",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:Region": "us-east-1"
                }
            }
        }
    ]
}
|improve this answer|||||
0

This one works for me, I tried to create policy with the json mentioned as a accepted answer but it does not work for me.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Action": "ec2:*",
        "Effect": "Allow",
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "ec2:Region": [
                    "us-east-1"
                ]
            }
        }
    }]
}
|improve this answer|||||
0

That's the current solution - using "eu-west-1":

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect"    : "Allow",
            "Action"    : "*",
            "Resource"  : "*",
            "Condition": 
            {
                "StringEquals": {
                    "aws:RequestedRegion": "eu-west-1"
                }
            }
        }
    ]
}
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.