AWS Identity and Access Management
User Guide

Amazon EC2: Limits Terminating EC2 Instances to an IP Address Range

This example shows how you might create a policy that limits EC2 instances by allowing the action, but explicitly denying access when the request comes from outside the specified IP range. The policy is useful when the IP addresses for your company are within the specified ranges. To use this policy, replace the red text in the example policy with your own information.

If this policy is used in combination with other policies that allow the ec2:TerminateInstances action (such as the AmazonEC2FullAccess AWS managed policy), then access is denied. This is because an explicit deny statement takes precedence over allow statements. For more information, see Determining Whether a Request is Allowed or Denied.


The aws:SourceIp condition key denies access to an AWS service, such as AWS CloudFormation, that makes calls on your behalf. For more information about using the aws:SourceIp condition key, see Available Global Condition Keys.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": [ "*" ] }, { "Effect": "Deny", "Action": [ "ec2:TerminateInstances" ], "Condition": {"NotIpAddress": {"aws:SourceIp": [ "", "" ]}}, "Resource": [ "*" ] } ] }