title: Allow AWS IAM user to launch only one ec2 instance
body: <p>In Amazon AWS, I would like to give my IAM-registered (Windows) user a small API-based program that will launch a custom AMI-based instance and then connect her machine to it.  Easy - but if the same user should try to launch another instance while the first is still running (from the same or another machine), the second and subsequent attempts must fail.  The AMI will be shared between multiple users.  The instance will be unique to the user.</p>
  
  <p>Note that this problem differs from some similar questions because I need to launch the instance on demand, but allow no further instances.  The goal is to prevent an application from being used more than is licensed.</p>
  
  <p>Ideally detecting and preventing this would all happen on the AWS side, because it is more secure.</p>
  
  <p>On the client side, I can see how I could use tags to do this - tag the launched instance with the users name, and search for tags before allowing an instance to start. </p>
  
  <p>Is there a way to do it on the server side, with IAM policy conditions or something?</p>