CLCS 615 – AWS Cloud Service and Resource Restrictions

Overview

To ensure a secure, reliable, and cost-efficient learning environment, the University of Maryland Global Campus (UMGC) has established AWS service and resource restrictions for students enrolled in CLCS 615.

These restrictions are managed centrally through AWS Control Tower and AWS Organizations using Service Control Policies (SCPs).

The policies are designed to provide students with access to the AWS resources needed to complete course assignments while preventing the deployment of unnecessary or excessively expensive cloud infrastructure.

Important: These restrictions apply to your assigned AWS student account, including activities performed through the AWS Management Console, AWS CLI, and supported automation tools.

1. Approved AWS Services

Students can use the following AWS services, subject to their assigned account permissions and resource restrictions.

Additional supporting AWS services may be available for authentication, infrastructure management, and account governance.

2. EC2 Virtual Machine Restrictions

To prevent unnecessary costs, students are restricted to the following Amazon EC2 instance types:

Not permitted:

• Large or high-performance EC2 instance types outside the approved list.
• GPU-enabled EC2 instances.
• Specialized high-memory or high-compute instances not included above.

If you attempt to deploy a restricted instance type, AWS may display an authorization error or prevent the instance from launching.

How to resolve: Return to the EC2 instance configuration screen and select one of the approved instance types.

3. Auto Scaling Restrictions

Students may create EC2 Auto Scaling groups to demonstrate automatic infrastructure scaling and resource management.

The configured restriction targets a maximum of three EC2 instances per Auto Scaling group.

Auto Scaling groups must also use approved EC2 instance types.

Note: This is a per-group restriction, not a guaranteed limit of three instances across your entire AWS account.

4. Storage Restrictions

Amazon Elastic Block Store (EBS) volume creation is restricted to help control storage costs.

Students should avoid provisioning unnecessary volumes or leaving storage resources allocated after completing their work.

These limits do not represent a total account-wide storage allowance.

5. Database Restrictions

Students may use Amazon RDS for assignments requiring relational databases.

Approved RDS instance classes:

• db.t3.micro
• db.t3.small
• db.t4g.micro
• db.t4g.small

The following database configurations are restricted:

• Larger RDS instance classes.
• Multi-AZ RDS database deployments.
• Amazon Aurora and other RDS cluster creation covered by the policy.
• Database storage configurations exceeding the permitted limit for covered operations.

Students can also use DynamoDB where their assignment requires a NoSQL database.

6. Networking Restrictions

Students can configure the AWS networking components necessary for their cloud architecture assignments, including VPCs, subnets, route tables, security groups, and supported load balancers.

However, the following networking resources are restricted:

These restrictions reduce unnecessary recurring networking costs.

Important: A private-subnet architecture that depends on a newly created NAT Gateway will not work under these restrictions. Students should use a supported alternative architecture or contact course support when an assignment explicitly requires the restricted resource.

7. AWS Services That Are Not Available

Certain AWS services are outside the approved CLCS 615 service catalog.

Examples include:

• Amazon Elastic Kubernetes Service (EKS)
• Amazon SageMaker
• Amazon Bedrock
• Amazon Redshift
• Amazon OpenSearch Service

Students attempting to access or deploy these services may receive an authorization error.

The restrictions are intentional and help ensure student AWS usage remains aligned with course requirements.

8. Additional Cost and Account Restrictions

To protect student accounts and prevent unexpected AWS expenses, the following activities are also restricted:

• Purchasing EC2 Reserved Instances or certain reserved capacity offerings.
• Purchasing AWS Savings Plans.
• Requesting AWS service quota increases.

Students remain responsible for following course instructions and terminating resources when they are no longer needed.

Note: AWS resource restrictions do not eliminate all AWS charges. Approved resources, including running EC2 instances, databases, and load balancers, may still generate usage costs.

9. Understanding AWS Access Denied Errors

If you attempt to create or configure a restricted AWS resource, you may receive an error similar to:

User is not authorized to perform: ec2:RunInstances because no service control policy allows the action.

Or:

Explicit deny in a service control policy.

These messages indicate that an AWS authorization policy may be preventing the requested action.

Recommended troubleshooting steps:

1. Verify that you are signed into your assigned CLCS 615 AWS student account.
2. Confirm that the service you are accessing is included in the approved service list.
3. Review the instance type, storage size, or resource configuration against the restrictions above.
4. Attempt the operation again using an approved configuration.
5. If the resource is required by your assignment and remains unavailable, contact the support team.

Not all access-denied messages are caused by SCP restrictions. Account permissions, authentication, resource ownership, and other security policies may also be responsible.

10. How These Restrictions Support Your Learning

The CLCS 615 restrictions are intended to preserve access to the services needed for cloud architecture and monitoring assignments.

You can continue to work with:

• Scalable web and application infrastructure.
• Application load balancing and Auto Scaling.
• Amazon CloudWatch monitoring, dashboards, and alerts.
• Cloud performance testing and architecture refinement.
• Cost optimization and resource management concepts.

Some advanced or high-cost architectures may need to be documented or simulated rather than deployed.

11. Need Additional Assistance?

If you receive an AWS access-denied error or cannot deploy a resource required by your CLCS 615 assignment, please contact the UMGC Support Team through the appropriate VLE support channel.

When submitting a support request, include:

• Course: CLCS 615
• AWS Account ID: Your assigned student AWS account ID
• AWS Service: The service you were attempting to use
• Resource Configuration: Instance type, storage size, or other relevant settings
• Error Message: The complete error displayed in AWS
• Screenshot: A screenshot showing the error and relevant configuration
• Assignment Reference: The assignment or lab step requiring the resource

This information will help the support team determine whether the issue is related to a course restriction or another AWS configuration problem.

If you need further assistance, please contact the UMGC Support Team and provide the information listed above.