Access Control Using IAM Instance Roles
Roles for EC2 Instances
Instance roles allow instances to access APIs to make requests. This alleviates some of the headache when trying to distribute credentials to instances that have applications running on them. In this demo, AWS expert Mike Wise will show you how an instance role can be created and utilized.
- From the AWS Management Console, navigate to the EC2 Dashboard, then to Instances.
- Click into an individual instance so that you can analyze the Description tab. Scroll down to IAM Role – does it have an instance role attached?
- If you want to further analyze an instance role, click into the IAM Role field and it will take you a Summary page of that role within the IAM Dashboard. This page shows you which permissions policies are attached to a specific role.
For a visual guide on how to create and utilize instance roles, watch the full demo. To learn more, read AWS’s resource for using an IAM role to grant permissions to applications running on Amazon EC2 instances.
So, first we’re going to need to log in to the AWS Management Console. Then, we’re going to need to search for “EC2.” Then, you’re going to go look at your instance list. As you know, within AWS you get an instance list. The instance list defines what the configuration characteristics are for the instances. We’re going to look at our instances here and then we’re going to identify where we can see the instance role.
First, we’ll look at the instance that does not have an instance role. As you can see here, if we scroll down and look at “IAM Role,” there is nothing defined. This instance does not have an instance role defined, so it doesn’t have any permissions being assigned to it via an instance role. Let’s go look at this one, however. If we look at this instance and we scroll down, we can see that it has an IAM role assigned. Let’s go see what the IAM role is.
If you go over and click on the “Instance Role” field, you can go to the role which will take you over to the “Identity and Access Management” tab. It will show you which policies are attached to the instance. We can see that, based on this role, this policy is attached. The permissions are being granted to the EC2 instance via the role that is defined within IAM. You can go into the “Identity and Access Management” console and create new policies to attach specific roles and permissions to instances.