title: “IAM Instance Profiles & EC2 Roles” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:
- aws
- iam
- ec2
- security
- certification
IAM Instance Profiles & EC2 Roles
What It Is
An Instance Profile is a container for an IAM Role that allows an EC2 instance to assume that role. The role defines what AWS services the instance can access and what operations it can perform — without embedding credentials on the instance.
Why It Matters
This is the recommended way to grant AWS permissions to EC2 instances. It avoids storing access keys on instances (a security anti-pattern). Heavily tested on exams.
Key Concepts
How It Works
EC2 Instance → Instance Profile → IAM Role → Permissions (Policies)
- An IAM Role is created with a trust policy allowing EC2 to assume it
- An Instance Profile wraps the role (in the Console, this is created automatically)
- The instance profile is attached to the EC2 instance at launch (or after)
- The instance gets temporary credentials via the EC2 metadata service
- AWS CLI and SDKs automatically use these credentials — no configuration needed
Authentication vs Authorization
| Concept | Provided By |
|---|---|
| Authentication (who am I?) | Instance Profile (role assumption) |
| Authorization (what can I do?) | IAM Policies attached to the Role |
Example: EC2 Accessing S3
- Role:
EC2InstanceProfileRole - Attached policy allows:
s3:GetObject,s3:PutObjectonarn:aws:s3:::mybucket/* - Result: EC2 can read/write objects in that bucket via
aws s3 cpwithout explicit credentials
Credential Delivery
- Temporary credentials are delivered via the Instance Metadata Service (IMDS)
- Endpoint:
http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name> - Credentials auto-rotate (typically every ~6 hours)
Gotchas
- An EC2 instance can have only one instance profile (and thus one role) at a time
- If the role doesn’t have the required permission, the API call fails with “Access Denied” — not “authentication failed”
- Changing the role’s policies takes effect immediately (no instance restart needed)
- In the Console, creating a role for EC2 auto-creates the instance profile; via CLI/API you must create them separately
See Also
- [[s3-bucket-policies]]
- [[aws-arns]]
- [[s3-fundamentals]]