Reply To: If deny ec2:RunInstances action with SCP, do not need IAM policy to

[mobious]

I just got through this question and it says both iam and the scp. I would only use an scp and then use aws config with a rule and an aggregator to catch the instances.

if you agree with this kenneth why is the question still the same.