Exempt from deny creating expensive ec2 (#1200)

* Allow creating g4dn.12xlarge instances * Exempt from deny creating expensive ec2 * Make ec2_exempted_accounts optional
dfds · Nov 15, 2023 · b60bee2 · b60bee2
1 parent e2be940
commit b60bee2
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/security/org-policies/preventive.tf b/security/org-policies/preventive.tf
@@ -19,6 +19,12 @@ data "aws_iam_policy_document" "preventive" {
         "*.metal",
       ]
     }
+
+    condition {
+      test     = "StringNotLike"
+      variable = "aws:PrincipalArn"
+      values   = var.ec2_exempted_accounts
+    }
   }
 
   statement {

diff --git a/security/org-policies/vars.tf b/security/org-policies/vars.tf
@@ -21,3 +21,8 @@ variable "reservation_policy_attach_targets" {
 variable "resource_owner_tag_value" {
   type = string
 }
+
+variable "ec2_exempted_accounts" {
+  type = list(string)
+  default = []
+}