Question

A company runs hundreds of project teams in a single AWS account. Each EC2 instance and each IAM role is tagged with a 'project' key identifying its owning team. The security team wants engineers to be able to start and stop only the EC2 instances belonging to their own project, without writing a separate IAM policy for every team as new projects are onboarded. Which approach best achieves this using least privilege at scale?

Accepted Answer

Write a single IAM policy that allows ec2:StartInstances and ec2:StopInstances with a condition requiring aws:ResourceTag/project to equal aws:PrincipalTag/project, and attach it to all engineer roles.

Answer

Create one IAM policy per project that lists the specific instance ARNs, and attach the correct policy to each team's role.

Answer

Attach an AWS managed policy granting full EC2 access to every engineer role and rely on an SCP to deny cross-project actions.

Answer

Create a permission boundary for each project team that restricts EC2 actions to that project's resources.