user-restricted-vpc-policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1562246744950",
      "Action": "*",
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "Stmt1562246979491",
      "Action": "iam:*",
      "Effect": "Deny",
      "Resource": "arn:aws:iam::898668804275:user/*"
    },
    {
      "Sid": "Stmt1562249989480",
      "Action": "ec2:*",
      "Effect": "Deny",
      "Resource": "arn:aws:ec2:us-east-1:898668804275:subnet/*",
      "Condition": {
        "StringEquals": {
          "ec2:Vpc": "arn:aws:ec2:us-east-1:898668804275:vpc/vpc-eba8d990"
        }
      }
    }
  ]
}



#https://docs.aws.amazon.com/vpc/latest/userguide/VPC_IAM.html



######################################################################

ec2-protection policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeInstances*",
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "ec2:StartInstances*",
                "ec2:StopInstances*",
                "ec2:RebootInstances*",
                "ec2:TerminateInstances*"
            ],
            "Resource": "arn:aws:ec2:us-east-1:898668804275:instance/*"
        }
    ]
}

# https://stackoverflow.com/questions/34356178/iam-policy-to-restrict-users-to-instances-in-a-specific-vpc