Cloud formation template for single policy based on the reInvent2015 talk https://www.youtube.com/watch?v=Du478i9O_mc

lock-down-access-to-instance-types.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: >
  Tempalte to create a managed policy to lock down users to create instance of a specific type

Parameters:
  InstanceTypes:
    Description: >
      Comma separated list of instance types that will be allowed by the policy
      e.g. "t1.*, t2.*, m3.*"
    Type: "CommaDelimitedList"
    Default: "t1.*, t2.*, m3.*"

Resources:
  LockDownAccessToInstanceTypesPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description: "Policy to enable users to manage specific instance types"
      Path: "/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "ec2:*"
            Resource: "*"
          -
            # Deny access if the instance types are not the ones described below
            Effect: "Deny"
            Action: "ec2:RunInstances"
            Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
            Condition:
              StringNotLikeIfExists:
                # Only apply this condition if this intance type key exists
                ec2:InstanceType: !Ref InstanceTypes

Outputs:
  LockDownAccessToInstanceTypesPolicy:
    Description: Policy to enable users to manage specific instance types
    Value: !Ref LockDownAccessToInstanceTypesPolicy
    Export:
      Name: !Sub "${AWS::StackName}-LockDownAccessToInstanceTypesPolicy"