How to restrict users in my AWS account from accessing public AMIs

Question

I want the users want to use the private [shared from another account] or owned AMIs only. I've tried searching in the AWS documentation and stckoverflow. Does any one know if this can be done? Thanks

Answer 1

You cannot restrict permissions for specific users within the specified AWS account. All users in the AWS account that you've specified can use the AMI or snapshot. http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/UsingIAM.html

Answer 2

I believe you can restrict to certain AMIs by following this document:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html#ex5

The 2nd example includes a policy that specifies a list of AMIs that can be launched, while the 3rd example show how to restrict to just Amazon AMIs.