title: AWS IAM Policy - Restrict VPC Tenancy
body: <p><strong>Requirement:</strong> To restrict IAM user from creating VPC with <strong>dedicated tenancy</strong>. IAM user should only be able to create VPC with <strong>default tenancy</strong>.</p>
  
  <p><strong>IAM Policy Attached to IAM User:</strong> </p>
  
  <pre><code>    {
          "Sid": "limitedTenancyVpc",
          "Effect": "Deny",
          "Action": "ec2:CreateVpc",
          "Resource": "arn:aws:ec2:*:*:vpc/*",
          "Condition": {
              "ForAnyValue:StringNotLike": {
                  "ec2:Tenancy": [
                      "default"
                  ]
              }
          }
      }
  </code></pre>
  
  <p>I know that for VPC <strong>InstanceTenancy</strong> is keyword to be used. I tried with it in condition, however it's not working. IAM user with this policy attached is able to create VPC with <strong>dedicated tenancy</strong>.</p>
  
  <p>Please suggest.</p>