IAM Instance Profile
💡 Definition
An IAM Instance Profile is a container for an IAM Role that you can use to pass role information to an EC2 instance when the instance starts. It allows applications running on the EC2 instance to obtain temporary credentials to access other AWS services.
🔑 Key Concepts
- Container for a Role: An instance profile is not a role itself, but a wrapper for a role that makes it usable by EC2.
- Temporary, Rotated Credentials: Applications on the EC2 instance can retrieve temporary security credentials from the instance metadata service. These credentials are automatically rotated by AWS, which is a major security benefit.
- Eliminates Hardcoded Keys: Prevents the need to store long-term AWS access keys directly on the instance, which is a significant security risk.
⚙️ How it Works
- Create an IAM Role: Create a role that grants the desired permissions (e.g.,
s3:PutObject) and set the trusted entity to be the EC2 service (ec2.amazonaws.com). - Create an Instance Profile: Create the instance profile and attach the role to it. (Note: When using the AWS Management Console, this step is often done automatically when you create the role for EC2).
- Attach to EC2: Associate the instance profile with the EC2 instance at launch time.
- Application Access: Your application code, using the AWS SDK, will automatically search for and use the credentials provided by the instance profile.
🎯 Use Cases
- Securely Accessing AWS Services from EC2: The standard and best-practice method for any application on an EC2 instance that needs to interact with other AWS services (like S3, DynamoDB, SQS, etc.).
💰 Pricing Model
- Free: Instance Profiles are a feature of IAM and are free to use.
📝 Exam Tips (CLF-C02)
- Keywords: "EC2 permissions", "Securely access services from EC2", "Pass a role to an instance".
- This is the correct and secure way to grant permissions to applications running on EC2 instances.
- Avoids storing access keys on the instance itself.
See Also: * IAM Role * EC2 * Principle of Least Privilege