CLCS 635 – AWS Cloud Service and Resource Restrictions

Overview

To provide a secure, reliable, and cost-efficient cloud learning environment, the University of Maryland Global Campus (UMGC) has established AWS service and resource restrictions for students enrolled in CLCS 635.

These restrictions are managed centrally through AWS Control Tower and AWS Organizations using Service Control Policies (SCPs).

The policies are designed to allow students to complete their cloud networking, infrastructure provisioning, connectivity testing, and security assignments while preventing the deployment of unnecessary or excessively expensive AWS resources.

Important: These restrictions apply to your assigned AWS student account, including activities performed through the AWS Management Console, AWS CLI, AWS CloudShell, and supported automation tools.

1. Approved AWS Services

Students may use the following AWS services, subject to their account permissions and course-specific resource restrictions.

Additional AWS services may be accessible for account authentication, security, and management.

Note: The Infrastructure Composer capability referenced in Unit 5 is a visual design tool associated with AWS CloudFormation rather than a separate general-purpose compute service.

2. EC2 Virtual Machine Restrictions

CLCS 635 students are permitted to deploy the following EC2 instance type:

The course's Unit 7 lab uses this instance type to deploy a public Linux instance and a private Linux instance.

Not permitted:

• EC2 instance types other than t2.micro.
• Large or high-performance virtual machines.
• GPU-enabled EC2 instances.
• Specialized high-memory and high-compute instances.

If you attempt to launch a restricted instance type, AWS may display an authorization error.

How to resolve: Return to the EC2 instance launch screen and select t2.micro.

EC2 Instance Quantity

The CLCS 635 labs require students to deploy two EC2 instances:

1. A public EC2 instance for internet connectivity and SSH access.
2. A private EC2 instance for testing internal network connectivity and outbound internet access.

Students should avoid creating additional instances unless specifically required by their assignments.

Note: The two-instance configuration is a course recommendation, not an account-wide limit enforced by the current SCPs.

3. AWS Region Restrictions

Students must use one of the following AWS Regions for EC2 and VPC resource deployment:

EC2 operations outside these Regions are restricted.

Important: The Unit 5 CloudFormation example specifies the us-east-2a Availability Zone. When following that example without modifying the template, select the Ohio (us-east-2) Region.

If you receive an access-denied error, verify that you are working in an approved Region.

4. Virtual Private Cloud (VPC) Restrictions

Students can create and manage the networking infrastructure required for their assignments, including:

• Virtual Private Clouds (VPCs)
• Public and private subnets
• Route tables and routing rules
• Internet Gateways
• NAT Gateways
• Security groups
• Elastic IP addresses

Recommended Network Configuration

The CLCS 635 labs use the following network design:

These values reflect the instructional lab architecture. They are not all enforced as maximum account-wide resource counts by the SCPs.

Students should follow their course instructions and avoid creating duplicate resources.

5. NAT Gateway and Elastic IP Access

Unlike some other AWS courses, CLCS 635 students are permitted to create NAT Gateways and allocate Elastic IP addresses.

These resources are necessary for completing the networking and connectivity exercises in Units 6 and 7.

Why These Resources Are Required

• Internet Gateway: Provides internet connectivity for resources in a public subnet when appropriately configured.
• NAT Gateway: Allows resources in a private subnet to initiate outbound connections to the internet.
• Elastic IP: Provides the public IPv4 address used by the course's public NAT Gateway configuration.

Important Cost Consideration

NAT Gateways generate charges while provisioned, even when they are not actively transferring data. Additional charges may apply for data processing and public IPv4 addresses.

Students should not create multiple NAT Gateways or allocate unnecessary Elastic IP addresses.

Do not delete lab resources that are required for subsequent assignments. Unit 5 resources are reused in Units 6 and 7. Follow the course's retention and cleanup instructions.

6. Restricted Networking Services

The following AWS networking resources are not permitted under the CLCS 635 resource restriction policy:

These advanced networking capabilities are not required for the assigned labs and may introduce additional infrastructure costs.

Students can continue to build their required public and private subnet architecture without these services.

7. AWS CloudFormation and CloudShell Access

Students are permitted to use AWS CloudFormation and AWS CloudShell to create and manage approved AWS resources.

AWS CloudFormation

CLCS 635 Unit 5 uses CloudFormation to provision:

• A VPC
• A public subnet
• A private subnet

Students may create, update, and delete supported CloudFormation stacks, subject to the restrictions of their AWS account.

Important: CloudFormation cannot be used to bypass AWS service or resource restrictions. A stack containing a prohibited resource may fail during deployment.

AWS CloudShell

CLCS 635 Units 6 and 7 use CloudShell for AWS CLI and Python automation.

Students may use CloudShell to:

• Execute AWS CLI commands.
• Allocate Elastic IP addresses.
• Create NAT Gateways.
• Configure route tables.
• Run Python scripts using the AWS Boto3 SDK.
• Deploy approved EC2 instances programmatically.

The same AWS authorization restrictions apply whether resources are created through the console, CLI, or Python scripts.

8. Additional EC2 and Cost Restrictions

To help control AWS expenses, the following actions are restricted:

• Creating EC2 Spot Fleets and certain alternative capacity configurations.
• Creating EC2 launch templates and launch template versions.
• Creating EC2 Capacity Reservations.
• Allocating dedicated EC2 hosts.
• Purchasing EC2 Reserved Instances or host reservations.
• Requesting AWS service quota increases.

Students should use the standard EC2 instance launch process outlined in their course materials.

The course's AWS networking exercises do not require purchasing long-term compute commitments or configuring advanced EC2 capacity options.

9. AWS Services That Are Not Available

CLCS 635 students are restricted from accessing AWS services outside the approved service catalog.

Examples of unavailable services include:

• Amazon Elastic Kubernetes Service (EKS)
• Amazon SageMaker
• Amazon Bedrock
• Amazon Redshift
• Amazon Relational Database Service (RDS)
• AWS Lambda
• Amazon API Gateway

These services are not required to complete the CLCS 635 networking assignments.

Attempting to access restricted services may result in an authorization error.

10. IAM and Account Security Restrictions

To protect student AWS accounts, certain IAM administration actions are restricted.

Examples include:

• Creating additional IAM users.
• Creating IAM access keys.
• Creating new IAM roles.
• Attaching managed policies to users or roles.
• Modifying selected IAM policies.
• Modifying role trust policies.

These controls help prevent unauthorized changes to account permissions.

Students should use their assigned UMGC authentication and AWS IAM Identity Center access rather than attempting to create alternative administrative credentials.

11. Understanding AWS Access Denied Errors

If you attempt an operation prohibited by the CLCS 635 restrictions, you may encounter an AWS error such as:

User is not authorized to perform: ec2:RunInstances

Or:

Explicit deny in a service control policy.

These errors may indicate that a service or resource restriction is preventing the requested action.

Troubleshooting Steps

1. Verify that you are signed into your assigned CLCS 635 AWS student account.
2. Confirm that you are working in the us-east-1 or us-east-2 Region.
3. If launching an EC2 instance, confirm that t2.micro is selected.
4. Verify that the AWS service is permitted under the approved service list.
5. Check whether the resource is required by the assignment instructions.
6. If using CloudFormation, review the stack events for the specific failed operation.
7. If using CloudShell, review the complete AWS CLI or Python error message.
8. If the issue continues, contact the UMGC Support Team.

Not every access-denied message is caused by an SCP. Other account permissions and security configurations can also affect access.

12. How These Restrictions Support Your Learning

The CLCS 635 restrictions are designed to preserve the functionality required to complete the assigned networking labs.

Students can continue to:

• Design IP addressing and subnetting configurations.
• Deploy VPCs and subnets using AWS CloudFormation.
• Configure public and private routing.
• Create Internet Gateways and NAT Gateways.
• Use AWS CloudShell and Python Boto3.
• Deploy public and private Linux EC2 instances.
• Configure security groups for SSH and ICMP connectivity.
• Verify network connectivity and outbound internet access.
• Understand the security differences between public and private cloud resources.

The Unit 2 Wireshark and Unit 3 subnetting exercises are primarily analytical activities and do not require provisioning additional AWS infrastructure.

13. Need Additional Assistance?

If you receive an AWS access-denied error or are unable to deploy a resource required by your CLCS 635 assignment, contact the UMGC Support Team through the appropriate VLE support channel.

When submitting a support request, please include:

• Course: CLCS 635
• AWS Account ID: Your assigned student AWS account ID
• AWS Region: The Region selected in the AWS console
• AWS Service: The service you are attempting to access
• Resource Configuration: Instance type, VPC settings, or other relevant configuration
• Error Message: The complete AWS error
• Screenshot: A screenshot showing the error and relevant configuration
• Assignment Reference: The unit and lab step you are attempting to complete

This information will help the support team determine whether the issue is related to an intentional course restriction or another AWS configuration problem.

If you need further assistance, please contact the UMGC Support Team and provide the information listed above.