how to customize AmazonEC2FullAccess - amazon-ec2

Question

I have an AWS account and have few folks added to a group, called "sales" and this group has "AmazonEC2FullAccess" IAM role assigned. My understanding is that the "sales" group is able to view all EC2 resources, create new instances and terminate any old ones.
I want to restrict this group to only view and create instances, and DONOT be able to remove any instances, How can i edit/change this AmazonEC2FullAccess role to disable the termination process of instances?

Answer 1

To answer your question directly, you can't change AmazonEC2FullAccess since it's a built-in policy. But you can explicitly deny EC2 instance termination by adding inline policy to this group like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1508489064000",
"Effect": "Deny",
"Action": [
"ec2:TerminateInstances"
],
"Resource": [
"arn:aws:ec2:us-east-1:ACCOUNT_ID:instance/*"
]
}
]
}
Assigning AmazonEC2FullAccess to sales people is a horrible idea.

Answer 2

I suggest you to use the minimum privilege method(provide access permission only for what is needed).
Attach the below Inline Custom policy to the Sales Group under Permissions tab.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateImage",
"ec2:CreateKeyPair",
"ec2:CreateNetworkInterface",
"ec2:CreatePlacementGroup",
"ec2:CreateSecurityGroup",
"ec2:CreateSnapshot",
"ec2:CreateVolume",
"ec2:ModifyHosts",
"ec2:AllocateAddress",
"ec2:AllocateHosts",
"ec2:AssignIpv6Addresses",
"ec2:AssignPrivateIpAddresses",
"ec2:AssociateAddress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AttachVolume",
"ec2:CopyImage",
"ec2:CopySnapshot",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:RebootInstances",
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "*"
}
]
}
This will allow them to perform basic operations with ec2 instances like creating instance, create security group for that instance, tags etc, But restricts them from performing delete operations. Basically, this policy is an extension of AmazonEC2ReadOnlyAccess policy.