RI・SavingsPlansを購入禁止にするポリシー

やりたい事

マルチアカウント環境で勝手にRI・SavingsPlansを購入して欲しくない

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Action": [
                "ec2:PurchaseReservedInstancesOffering",
                "savingsplans:CreateSavingsPlan",
                "elasticache:PurchaseReservedCacheNodesOffering",
                "es:PurchaseReservedElasticsearchInstanceOffering",
                "redshift:PurchaseReservedNodeOffering",
                "rds:PurchaseReservedDBInstancesOffering",
                "dynamodb:PurchaseReservedCapacityOfferings",
                "cloudfront:CreateSavingsPlan"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

まとめ

上記内容でSCPを作成し、任意のOUに割り当てる