Restrict IAM users to a single VPC

Question

I have two VPC in my account. One for Test and other for Prod environment.

I am trying to setup IAM user accounts for developers, with permission boundaries, so that deve

Answer 1

What I get is you are trying to restrict users to the services which are under a particular VPC. I did the same thing for allowing users to update Lambda functions which are inside a particular VPC only. This can be done like below:

{
  "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllResources",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        },
        {
            "Sid": "DenyLambdaUpdatIfNotInsideVPC",
            "Effect": "Deny",
            "Action": [
                "lambda:CreateFunction",
                "lambda:UpdateFunctionConfiguration"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "lambda:VpcIds": "your vpc id"
                }
            }
        }
    ]
}

In this way you can restrict users from accessing the resources which are outside your VPC by writing services and their specific actions in the deny statement.