title: aws organization SCP policy to deny any ec2 instances in any VPCs with public IPs
body: <p>With the company compliance policy, I am looking for solution to block the clients (100+ aws accounts) to create ec2 instances with public IPs or try to attach elastic IPs on it after created.</p>
  <p>I am thinking to use <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html" rel="nofollow noreferrer">AWS Organization SCP</a> to implement it, so I don't need set it in individual account. But can't get the proper SCP policy to do it.</p>
  <p>A SCP policy for your reference that I can block s3 public access with below policy, I need similar to ec2 instances.</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: [
                  &quot;s3:PutAccountPublicAccessBlock&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;
          }
      ]
  }
  </code></pre>
  <p>Idealy, with the proper SCP policy, when client in their account under Orgainzation OU, they can't create ec2 instance if they allow public IP on it, or after created the ec2, when they try to attach elastic IP, the scp should block it.</p>
  <h3>Updates</h3>
  <p>Thanks, @john</p>
  <p>let me try this policy</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: [
                  &quot;ec2:AssociateAddress&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;
          }
      ]
  }
  </code></pre>
  <h3>update #2</h3>
  <p>Above scp policy doesn't work, I can still create new instance with public IPs</p>