IAM Instance Profiles

What are IAM Instance Profiles?

An IAM instance profile is a way to grant access to resources that your EC2 instances require. An IAM instance profile can be chosen to be applied to an EC2 instance when it is launched. As a result, the instance can access AWS resources linked to its IAM instance profile. As an example, you could create an IAM instance profile with access rights to an S3 bucket and use that profile to launch an EC2 instance. Using the IAM instance profile's permissions, the EC2 instance would then be able to access the S3 bucket. This provides a simple and secure method of granting EC2 instance access to particular AWS resources without requiring us to manually manage the EC2 instance's associated credentials.

Steps to create IAM Instance Profile

The following steps highlight how to create an AWS IAM instance profile using the AWS CLI.

1. Use the AWS CLI to run the following command to create an IAM role for the instance profile:

Replace "trust-policy.json" with the file containing the trust policy for the role. The trust policy determines which entities are allowed to assume the role. Example:

2. To create an IAM policy that grants access to the resources that the instance will use, execute the command below:

Change "permissions-policy.json" with the file containing the policy's permissions policy. The actions that a role is permitted to take on resources are determined by the permissions policy.

3. Attach the policy to the role by running the following command:

The policy ARN can be found in the output of the create-policy command. 4. Run the following command to create the instance profile:

5. Run the following command to add the role to the instance profile:

The above steps will create an AWS IAM instance profile that can be attached to an EC2 instance during launch.

Managing Instance Profiles

Console

The AWS management console automatically creates an instance profile for the IAM role with the same name as the IAM role for the roles that are associated with the EC2 instances. There are no manual steps required to create an AWS IAM instance profile using the AWS console.

CLI

The following commands can be used to manage the AWS IAM instance profiles using the AWS CLI:

1. Delete an instance profile

2. To get information about an instance profile.

3. To see a list of all the instance profiles in your AWS account:

4. To remove a role from an instance profile:

API

The following commands can be used to manage the AWS IAM instance profiles using the AWS API using any available AWS SDK:

1. CreateInstanceProfile:
   Creates a new instance profile.
2. DeleteInstanceProfile:
   Deletes an instance profile.
3. GetInstanceProfile:
   Retrieves information about an instance profile
4. ListInstanceProfiles:
   Lists all the instance profiles.
5. AddRoleToInstanceProfile:
   Adds a role to an instance profile.
6. RemoveRoleFromInstanceProfile:
   Removes a role from an instance profile.