How do I allow EKS Auto Mode, ECS Managed Instances, and Lambda to launch EC2 instances when using Service Control Policies (SCPs) ?

Resolution

Prerequisites

Before you begin, make sure you have:

• AWS Organizations with SCPs enabled
• Permissions to create and attach SCPs in your organization
• Knowledge of the AWS regions where you operate
• Understanding of your organization's security requirements

Create the SCP policy

This SCP uses an exception-based deny approach that blocks EC2 instance launches unless they use AMIs from AWS-owned accounts for EKS Auto Mode, ECS Managed Instances, and Lambda Managed Instances.

Important: The policy denies instance launches that use AMIs from accounts other than the specified AWS-owned accounts. This allows managed services to operate while blocking direct user launches with custom AMIs.

1. Open the AWS Organizations console.

2. In the navigation pane, choose Policies, and then choose Service control policies.

3. Choose Create policy.

4. Enter a name for the policy, such as AllowManagedServicesOnly.

5. In the policy editor, enter the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyEC2RunInstancesExceptManagedServices",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*::image/*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceAccount": [
            "891376953411",
            "832570432258",
            "118124083970"
          ]
        }
      }
    }
  ]
}

6. Choose Create policy.

Note: The AMI account IDs shown in this example are specific to the eu-central-1 region:

• 891376953411 - EKS Auto Mode AMI account
• 832570432258 - ECS Managed Instances AMI account
• 118124083970 - Lambda Managed Instances AMI account

Important: This policy allows users to manually launch EC2 instances if they use one of the managed AMIs owned by EKS Auto Mode, ECS Managed Instances , or Lambda Managed Instances. If you need to prevent all manual EC2 launches, you must implement additional IAM policy restrictions.

Update the policy for your region

The AMI account IDs vary by AWS region. You must update the policy with the correct account IDs for your region.

To find the AMI account IDs for your region:

• To find the account IDs of the AMIs owned by EKS Auto Mode, see EKS Auto Mode controls and AMI accounts.
• To find the account IDs of the AMIs owned by ECS managed instances, see ECS managed instances AMI accounts.
• Lambda Managed Instances AMI account IDs are not published in the AWS documentation. Use the script below to discover them.

Discover Lambda Managed Instances AMI account IDs:

Unlike EKS Auto Mode and ECS Managed Instances, AWS does not publish a list of Lambda AMI account IDs per region. You can discover them by querying the AMIs directly:

regions="ap-south-1 ca-central-1 eu-central-1 us-west-1 us-west-2 eu-north-1 eu-west-3 eu-west-2 eu-west-1 ap-northeast-3 ap-northeast-2 ap-northeast-1 sa-east-1 ap-southeast-1 ap-southeast-2 us-east-1 us-east-2"

echo -e "Region\tAccount ID"
echo -e "------\t----------"

for region in $regions; do
  account_id=$(aws ec2 describe-images \
    --region "$region" \
    --filters "Name=name,Values=aws-lambda-managed-instances-*" \
    --query 'Images[0].OwnerId' \
    --output text 2>/dev/null)

  if [ -n "$account_id" ] && [ "$account_id" != "None" ]; then
    echo -e "$region\t$account_id"
  else
    echo -e "$region\tNot Found"
  fi
done

Note: You need the ec2:DescribeImages permission to run this script. The AMI account IDs may change over time, so re-run this script periodically to verify them.

Attach the SCP to your organization

1. In the AWS Organizations console, navigate to the organizational unit (OU) or account where you want to apply the policy.

2. Choose Policies, and then choose Service control policies.

3. Choose Attach next to the policy you created.

4. Select the target OU or account, and then choose Attach policy.

Important: Test the policy in a non-production OU before applying it to production accounts.

Verify the policy

After attaching the SCP, verify that:

1. EKS Auto Mode can provision nodes when you deploy workloads
2. ECS Managed Instances can be created for your tasks
3. Lambda Managed Instances capacity provider can provision instances
4. Direct EC2 launches with custom AMIs are blocked

To test that direct launches are blocked, attempt to launch an instance with a custom AMI. The operation should fail with an authorization error.

How the policy works

Resource ARN format

The policy uses arn:aws:ec2:*::image/* as the resource ARN. Note the double colon (::) before image/*. This is the correct format for AMI resources, which don't include an account ID in their ARN structure.

Exception-based deny logic

The policy uses a StringNotEquals condition on aws:ResourceAccount to create exceptions to the deny rule. This allows instance launches that use AMIs from the specified AWS-owned accounts. Each managed service (EKS Auto Mode, ECS Managed Instances, and Lambda Managed Instances) uses official AMIs owned by dedicated AWS accounts, while user launches typically use custom AMIs from other accounts.

The deny rule applies to all EC2 instance launches UNLESS the AMI belongs to one of the allowed AWS-owned accounts, effectively allowing managed services while blocking direct user launches.

Advanced configuration

Allow custom AMIs from your organization

If you need to allow specific custom AMIs from your organization, add your AWS account ID to the aws:ResourceAccount list:

"aws:ResourceAccount": [
  "891376953411",
  "832570432258",
  "118124083970",
  "<your-aws-account-id>"
]

Replace <your-aws-account-id> with your AWS account ID.

Important: Adding your account ID allows users to launch instances with your custom AMIs. Ensure you have proper AMI governance and approval processes in place.

Related information

• AWS Organizations
• EKS Auto Mode controls and AMI accounts
• ECS managed instances AMI accounts
• Lambda Managed Instances
• ECS Managed Instances
• Amazon EKS Auto Mode
• Service Control Policies
• IAM policy evaluation logic
• EC2 condition keys reference