skills.rest
richardnroman
richardnromanCOMMUNITY
Explore all skills by this author →
GitHub

setting-up-ec2-instance-profiles

Configures IAM roles and instance profiles to grant EC2 instances temporary AWS credentials.

Updated Jul 21, 2026
Search Tags:#aws#credentials#iam#ec2#cloud security#least privilege#instance profile
One-click install
npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill setting-up-ec2-instance-profiles-richardnroman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: setting-up-ec2-instance-profiles
Source: https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform/tree/main/.agents/skills/setting-up-ec2-instance-profiles
Command: npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill setting-up-ec2-instance-profiles-richardnroman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Applications running on EC2 often rely on hardcoded AWS credentials, which is insecure and hard to rotate. This Skill guides the full setup of IAM roles and instance profiles so EC2 instances obtain temporary credentials automatically through the metadata service. ## Core Features & Use Cases - Least-Privilege Permission Planning: Analyzes requested services (S3, DynamoDB, SQS, CloudWatch, and more) and recommends scoped actions and resource ARNs instead of broad FullAccess policies. - End-to-End Setup Procedure: Covers role creation or reuse, trust policy validation, policy attachment, instance profile creation, and association with the target instance, including replacement of existing profiles. - Verification and Reporting: Provides IMDSv2-based credential tests, SDK code examples for Python, Node.js, and Java, plus a configuration summary report with security recommendations and cleanup commands. - Use Case: A web server on EC2 needs to write logs to CloudWatch and read objects from S3; the Skill walks through creating a scoped role, attaching it via an instance profile, and verifying access from inside the instance. ## Quick Start Ask the agent to set up an EC2 instance profile for your instance by providing the instance ID, region, and the AWS services it needs to access.

Frequently Asked Questions about setting-up-ec2-instance-profiles

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I give an EC2 instance access to S3 without hardcoded credentials?▼

Create an IAM role with an EC2 trust policy, attach scoped S3 permissions, place the role in an instance profile, and associate it with the instance. The AWS SDK default credential chain then retrieves temporary credentials from the instance metadata service automatically.

How to attach an IAM instance profile to an existing EC2 instance?▼

Use aws ec2 associate-iam-instance-profile with the instance ID and profile name. If a profile is already attached, first disassociate it using its association ID, wait for disassociation, then attach the new profile and verify with describe-instances.

What permissions should an EC2 instance role have for DynamoDB and SQS?▼

Follow least privilege: grant specific actions like dynamodb:GetItem and dynamodb:PutItem on specific table ARNs, and sqs:SendMessage or sqs:ReceiveMessage on specific queue ARNs. Avoid FullAccess managed policies; prefer custom inline policies scoped to exact resources.

Why are instance profile credentials not available after attaching the role?▼

Instance profile propagation typically takes 30 to 60 seconds after attachment. Applications may also cache old credentials and need a restart. Verify availability using IMDSv2 token-based requests against the metadata service at 169.254.169.254.

Can I reuse an existing IAM role for an EC2 instance profile?▼

Yes, if the role's trust policy allows the ec2.amazonaws.com service principal to assume it. The procedure verifies the trust policy, lists attached and inline policies for review, and lets you add permissions or use the role as-is.

How do I test instance profile credentials from inside the EC2 instance?▼

Use IMDSv2: request a session token with a PUT to the metadata API, then query the iam/security-credentials endpoint with that token. Running aws sts get-caller-identity confirms the CLI picks up the role credentials automatically.

Related Skills

Explore More Software Engineering Skills→
X-School-AcademyX-School-Academy
19

aws-ec2

Manage AWS EC2 instances, AMIs, and networking configurations.

Official
Intermediate
farslabfarslab

aws-cost-operations

Analyze AWS costs, configure CloudWatch alarms, and audit CloudTrail activity using MCP servers.

Community
Advanced
xalgordxalgord
954

securing-aws-lambda-execution-roles

Implements least-privilege IAM execution roles for AWS Lambda functions using Access Analyzer and permission boundaries.

Community
Advanced
awsaws
2.3k

setting-up-ec2-instance-profiles

Configure EC2 instances with IAM roles and instance profiles for AWS service access.

Official
Advanced