AWS IAM policy to allow Cloudformation actions - amazon-web-services

Question

Originally asked on https://forums.aws.amazon.com/thread.jspa?messageID=825006#825006
I am trying to restrict certain actions to specific sources. For example, EC2 and Cloudformation should only be accessible from a certain source IP address. I am able to achieve this with the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": ["ec2:*", "cloudformation:*"],
"Resource": "*",
"Condition": {
"NotIpAddress": { "aws:SourceIp": ["1.2.3.4"] }
}
}
]
}
This works great (assuming there is an allow on ec2 and cloudformation without condition for the user) in that I can now create / view EC2 instances from source IP 1.2.3.4 but get errors trying from other sources.
However, if I try create a Cloudformation stack that contains an EC2 instance, the RunInstance action inherits my user account, but not my source IP. I would like to update the condition to allow Cloudformation source to be excluded from the Deny. I have tried this:
"Condition": {
"NotIpAddress": { "aws:SourceIp": ["1.2.3.4"] },
"StringNotEquals": {"aws:SourceIp":"cloudformation.amazonaws.com" }
}
}
I have also tried 2 Allow statements on those actions, each statement only having 1 condition - IpAddress with the sourceIp and the 2nd allow statement with "StringEquals" : {"aws:SourceIp":"cloudformation.amazonaws.com"} to those actions. I still get an error when CloudFormation tries to execute RunInstances action.
Here's the CloudTrail event showing the failure:
{
"eventVersion": "1.05",
"userIdentity": {
"type": "AssumedRole",
"principalId": "REDACTED",
"arn": "REDACTED",
"accountId": "REDACTED",
"sessionContext": {
"attributes": {
"creationDate": "2018-01-19T07:47:40Z"
},
"sessionIssuer": {
"type": "Role",
"principalId": "REDACTED",
"arn": "arn:aws:iam::REDACTED",
"accountId": "REDACTED",
"userName": "REDACTED"
}
},
"invokedBy": "cloudformation.amazonaws.com"
},
"eventTime": "2018-01-19T08:10:39Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "RunInstances",
"awsRegion": "REDACTED",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"errorCode": "Client.UnauthorizedOperation",
"errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: REDACTED",
"requestParameters": { <details of instance here> },
"responseElements": null,
"requestID": "REDACTED",
"eventID": "REDACTED",
"eventType": "AwsApiCall",
"recipientAccountId": "REDACTED"
}
I have tried string matches on aws:SourceIp, aws:SourceIpAddress, aws:UserAgent - How can I allow ec2 actions to cloudformation?
Thanks.