This lab is provided as part of AWS Innovate For Every Application Edition

Click here to explore the full list of hands-on labs.

ℹ️ You will run this lab in your own AWS account. Please follow directions at the end of the lab to remove resources to avoid future costs.

This hands-on lab will guide you through the steps to implement cost and usage governance. The skills you learn will help you control your cost and usage in alignment with your business requirements.

• Implement IAM Policies to control usage

• A small number of instances will be started & then immediately terminated
• Costs will be less than $5 if all steps including the teardown are performed

• The lab should take approximately 30 minutes to complete

This lab requires you to develop a restrictive IAM policy, then apply the policies to a group of users, then login as a user in that group and verify the policy. We will create this test group.

1. Go to the IAM service page:

2. Click on Groups, click Create New Group:

3. Set the group name to CostTest and click Create Group:

4. Click Users and Add users:

5. Configure the user as follows:

   • Username: TestUser1
   • Access type: Password - AWS Management Console access
   • Console password: Autogenerated password
   • Un-select Require password reset
   • Click Next: Permissions

6. Select the CostTest group, and click Next: Tags:

7. Click Next: Review:

8. Review the details and click Create user:

9. Record the logon link, the User and the Password for later use, click Close:

To manage costs you need to manage and control your usage. AWS offers multiple regions, so depending on your business requirements you can limit access to AWS services depending on the region. This can be used to ensure usage is only allowed in specific regions which are more cost effective, and minimize associated usage and cost, such as data transfer.

We will create a policy that allows all EC2, RDS and S3 access in a single region only. NOTE: it is best practice to provide only the minimum access required, the policy used here is for brevity and simplicity, and should only be implemented as a demonstration before being removed.

1. Go to the IAM service page:

2. Select Policies from the left menu and Click Create Policy:

3. Click the JSON tab:

4. Copy and paste the policy into the console:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "ec2:*",
                    "rds:*",
                    "s3:*"
                ],
                "Resource": "*",
        "Condition": {"StringEquals": {"aws:RequestedRegion": "us-east-1"}}
            }
        ]
    }

6. Click Next:Tags and Next: Review:

7. Create the policy with the following details:

   • Name: RegionRestrict
   • Description: EC2, RDS, S3 access in us-east-1 only
   • Click Create policy:

You have successfully created an IAM policy to restrict usage by region.

1. Select User groups from the left menu:

2. Click on the CostTest group (created previously):

3. Select the Permissions tab:

4. Click on Add permissions dropdown list and choose Attach Policies:

5. Click Policy Type and select Customer Managed:

6. Select the checkbox next to RegionRestrict (created above) and click Add permissions:

You have successfully attached the policy to the CostTest group. Log out from the console

1. Logon to the console as the TestUser1 user, go to the EC2 Service dashboard:

2. Click the current region in the top right, and select US West (N.California):

3. Try to launch an instance by clicking Launch Instance, select Launch Instance:

4. Click on Select next to the Amazon Linux 2 AMI, You will receive an error when you select an AMI as you do not have permissions:

You have successfully verified that you cannot launch any instances outside of the N.Virginia region. We will now verify we have access in us-east-1 (N.Virginia):

5. Change the region by clicking the current region, and selecting US East (N.Virginia):

6. Now attempt to launch an instance, choose the Amazon Linux 2 AMI, leave 64-bit (x86) selected, click Select:

7. Scroll down and select a c5.large, and click Review and Launch:

8. Take note of the security group created (as you need to delete it), Click Launch:

9. Select Proceed without a key pair, and click I acknowledge.. checkbox, and click Launch Instances:

10. You will get a success message, click on the instance id:

11. Ensure the correct instance is selected, click Actions, then Instance State, then Terminate:

12. Confirm the instance ID is correct, click Yes, Terminate:

13. Log out of the console as TestUser1.

You have successfully implemented an IAM policy that restricts all EC2, RDS and S3 operations to a single region. You have also successfully launched a c5 Instance Type.

AWS offers different instance families within EC2. Depending on your workload requirements - different types will be most cost effective. For non-specific environments such as testing or development, you can restrict the instance families in those accounts to the most cost effective generic types. It is also an effective way to increase Savings Plan or Reserved Instance utilization, by ensuring these accounts will consume any available commitment discounts.

We will create a policy that allows operations on specific instance families only. This will not only restrict launching an instance, but all other activities. NOTE: it is best practice to provide only the minimum access required, the policy used here is for brevity and simplicity, and should only be implemented as a demonstration before being removed.

1. Log on to the console as your regular user with the required permissions, Go to the IAM service page:

2. Select Policies from the left menu:

3. Click Create Policy:

4. Click on the JSON tab:

5. Copy and paste the policy into the console:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "ec2:*",
                "Resource": "*",
                "Condition": {
                    "ForAllValues:StringLike": {
                        "ec2:InstanceType": [
                            "t3.*",
                            "a1.*",
                            "m5.*"
                        ]
                    }
                }
            }
        ]
    }

6. Click Review policy:

7. Enter the details:

   • Name: EC2_FamilyRestrict
   • Description: Restrict to t3, a1 and m5 families
   • Click on Create Policy:

You have successfully created an IAM policy to restrict usage by Instance Family.

1. Click on Groups from the left menu:

2. Click on the CostTest group (created previously):

3. We need to remove the RegionRestrict policy, as it permitted all EC2 actions. Click on Detach Policy for RegionRestrict:

4. Click on Detach:

5. Click on Attach Policy:

6. Click on Policy Type, then click Customer Managed:

7. Select the checkbox next to Ec2_FamilyRestrict, and click Attach Policy:

You have successfully attached the policy to the CostTest group. Log out from the console

1. Logon to the console as the TestUser1 user, go to the EC2 Service dashboard:

2. Try to launch an instance by clicking Launch Instance, select Launch Instance:

3. Click on Select next to the Amazon Linux 2 AMI:

4. We will select an instance we are not able to launch first, so select a c5.large instance, click Review and Launch:

5. Make note of the security group created, click Launch:

6. Select Proceed without a key pair, and click I acknowledge that I will not be able to..., then click Launch Instances:

7. You will receive an error, notice the failed step was Initiating launches. Click Back to Review Screen:

8. Click Edit instance type:

9. We will select an instance type we can launch (t3, a1 or m5) select t3.micro, and click Review and Launch:

10. Select Yes, I want to continue with this instance type (t3.micro), click Next:

11. Click Launch:

12. Select Proceed without a key pair, and click I acknowledge that i will not be able to..., then click Launch Instances:

13. You will receive a success message. Click on the Instance ID and terminate the instance as above:

14. Log out of the console as TestUser1.

You have successfully implemented an IAM policy that restricts all EC2 actions to T3, A1 and M5 instance types.

We can also restrict the size of instance that can be launched. This can be used to ensure only low cost instances can be created within an account. This is ideal for testing and development, where high capacity instances may not be required. We will extend the EC2 family policy above, and add restrictions by adding the sizes of instances allowed.

1. Log on to the console as your regular user with the required permissions, go to the IAM service page:

2. Click on Policies on the left menu:

3. Click on Filter policies, then select Customer managed:

4. Click on EC2_FamilyRestrict to modify it:

5. Click on Edit policy:

6. Click on the JSON tab:

7. Modify the policy by adding in the sizes, add in nano, medium, large, be careful not to change the syntax and not remove the quote characters. Click on Review policy:

8. Click on Save changes:

9. Log out from the console

You have successfully modified the policy to restrict usage by instance size.

1. Logon to the console as the TestUser1 user, click on Services and go to the EC2 dashboard:

2. Try to launch an instance by clicking Launch Instance, select Launch Instance:

3. Click on Select next to the Amazon Linux 2 AMI:

4. We will attempt to launch a t3.micro which was successful before. Click on Review and Launch:

5. Review the configuration and take note of the security group created, click Launch:

6. Select Proceed without a key pair, and click I acknowledge that i will not be able to..., then click Launch Instances:

7. You will get a failure, as it wasn't a size we allowed in the policy. Click Back to Review Screen:

8. Click Edit instance type:

9. We will now select a t3.nano which will succeed. Click Review and Launch:

10. Select Yes, I want to continue with this instance type (t3.nano), and click Next:

11. Review the configuration and click Launch:

12. Select Proceed without a key pair, and click I acknowledge that i will not be able to..., then click Launch Instances:

13. It will succeed. Click on the Instance ID and terminate the instance as above:

14. Log out of the console as TestUser1.

You have successfully implemented an IAM policy that restricts all EC2 instance operations by family and size.

Extending cost optimization governance beyond compute instances will ensure overall higher levels of cost optimization. Similar to EC2 instances, there are different storage types. Governing the type of storage that can be created in an account can be effective to minimize cost.

We will create an IAM policy that denies operations that contain provisioned IOPS (io1) EBS volume types. This will not only restrict creating a volume, but all other actions that attempt to use this volume type.

NOTE: it is best practice to provide only the minimum access required, the policy used here is for brevity and simplicity, and should only be implemented as a demonstration before being removed.

1. Log on to the console as your regular user with the required permissions, go to the IAM service page:

2. Click on Policies on the left menu:

3. Click Create policy:

4. Click on the JSON tab:

5. Copy and paste the policy into the console:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Deny",
                "Action": "ec2:*",
                "Resource": "*",
                "Condition": {
                    "StringEquals": {
                        "ec2:VolumeType": "io1"
                    }
                }
            }
        ]
    }

6. Click on Review Policy:

7. Configure the following details:

   • Name: EC2EBS_Restrict
   • Description: Dont allow EBS io1 volumes
   • Click Create policy:

You have successfully created an IAM policy to restrict EBS actions by volume type.

1. Click on Groups from the left menu:

2. Click on the CostTest group:

3. Click on Attach Policy:

4. Click on Policy Type, then click Customer Managed:

5. Select the checkbox next to EC2EBS_Restrict, and click Attach Policy:

You have successfully attached the policy to the CostTest group. Log out from the console

1. Logon to the console as the TestUser1 user, click on Services then click EC2:

2. Try to launch an instance by clicking Launch Instance, select Launch Instance:

3. Click Select next to Amazon Linux 2...:

4. Select t3.nano (which is allowed as per our already applied policy, which we tested in the last exercise), click Next: Configure Instance Details:

5. Click Next Add Storage:

6. Click on Add New Volume, click on the dropdown, then select Provisioned IOPS SSD (io1):

7. Click Review and Launch:

8. Take note of the security group created, and click Launch:

9. Select Proceed without a key pair, and click I acknowledge that i will not be able to..., then click Launch Instances:

10. The launch will fail, as it contained an io1 volume. Click Back to Review Screen:

11. Scroll down and click Edit storage:

12. Click the dropdown and change it to General Purpose SSD(gp2), click Review and Launch:

13. Click Launch:

14. Select Proceed without a key pair, and click I acknowledge that i will not be able to..., then click Launch Instances:

15. It will now succeed, as it doesn't contain an io1 volume type. Click on the instance ID and terminate the instance as above:

16. Log out of the console as TestUser1.

You have successfully implemented an IAM policy that denies operations if there is an EBS volume of type io1.

Log onto the console as your regular user with the required permissions.

We will delete the IAM policies created, as they are no longer applied to any groups.

1. Log on to the console as your regular user with the required permissions, go to the IAM service page:

2. Click on Policies on the left:

3.Click on Filter Policies and select Customer managed:

4. Select the policy you want to delete Region_Restrict:

5. Click on Policy actions, and select Delete:

6. Click on Delete:

7. Perform the same steps above to delete the Ec2_FamilyRestrict and EC2EBS_Restrict policies.

8. Click on Groups:

9. Select the CostTest group, click Group Actions, click Delete Group:

10. Click Yes, Delete:

11. Click Users:

12. Select TestUser1, and click Delete user:

13. Click Yes, delete:

14. Go to the EC2 dashboard:

15. Click Security Groups on the left:

16. Select the security groups you took note of, ensure you have the correct groups that were created. Click Actions, select Delete Security Groups:

17. Triple check they are the groups you wrote down, and click Yes, Delete:

18. Confirm there are no io1 unattached EBS volumes, go to the EC2 dashboard, click on Elastic Block Store, click Volumes. You can sort by the Created column to help identify volumes that were not terminated as part of this lab.

Let us know what you thought of this lab and how we can improve the experience for you in the future by completing this poll. Participants who complete the surveys from AWS Innovate Online Conference will receive a gift code for USD25 in AWS credits 1, 2 & 3. AWS credits will be sent via email by September 30, 2022.

Note: Only registrants of AWS Innovate Online Conference who complete the surveys will receive a gift code for USD25 in AWS credits via email.

1. AWS Promotional Credits Terms and conditions apply: https://aws.amazon.com/awscredits/
2. Limited to 1 x USD25 AWS credits per participant.
3. Participants will be required to provide their business email addresses to receive the gift code for AWS credits.