title: AWS IAM - EC2 - Restrict access to specific subnet
body: <p>I am trying to create a policy to limit users to only run instances in a certain subnet, but the following isn't working (anonymising the account ID, Subnet ID and SID)</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "SID",
          "Effect": "Allow",
          "Action": [
              "ec2:DescribeImages",
              "ec2:DescribeInstances",
              "ec2:DescribeTags",
              "ec2:StartInstances",
              "ec2:StopInstances"
          ],
          "Resource": [
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER:subnet/subnet-id",
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::network-interface/*",
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::instance/*",
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::volume/*",
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::image/ami-*",
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::key-pair/*",
              "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::security-group/*"
          ]
      }
  ]
  </code></pre>
  
  <p>}</p>
  
  <p>ALso I have tried this, which is also not working</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "SID",
          "Effect": "Allow",
          "Action": [
              "ec2:DescribeImages",
              "ec2:DescribeInstances",
              "ec2:DescribeTags",
              "ec2:StartInstances",
              "ec2:StopInstances"
          ],
          "Condition": {
              "StringEquals": {
                  "ec2:subnet": "subnet-id"
              }
          },
          "Resource": [
              "*"
          ]
      }
  ]
  </code></pre>
  
  <p>}</p>
  
  <p>Would appreciate any input people have, thanks!</p>