EC2 Instance Profiles in AWS

Using AWS CLI

# 1. Create IAM role with trust policy
cat > ec2-trust-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# 2. Create the role
aws iam create-role \
  --role-name S3ReadOnlyRole \
  --assume-role-policy-document file://ec2-trust-policy.json

# 3. Attach policy to role
aws iam attach-role-policy \
  --role-name S3ReadOnlyRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# 4. Create instance profile
aws iam create-instance-profile \
  --instance-profile-name S3ReadOnlyProfile

# 5. Add role to instance profile
aws iam add-role-to-instance-profile \
  --role-name S3ReadOnlyRole \
  --instance-profile-name S3ReadOnlyProfile

Use Condition Keys

Refine permissions with condition keys to add additional security controls.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-app-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/Environment": "Production"
        },
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

OpenAI (ChatGPT)

OpenAI uses instance profiles to grant their AI training clusters secure access to S3 buckets containing training data and model artifacts. By using instance profiles, they can ensure that only specific EC2 instances running their training workloads can access sensitive data, while automatically rotating credentials for enhanced security.

Security Benefits

• Eliminates the need to store long-term credentials on EC2 instances
• Credentials are automatically rotated (typically every hour)
• Reduces risk of credential exposure through application code or logs
• Follows the principle of least privilege when properly configured
• Enables fine-grained access control through IAM policies

Operational Advantages

• Simplifies credential management across large fleets of instances
• No need to rotate or distribute credentials manually
• Works seamlessly with Auto Scaling Groups
• Integrates natively with AWS SDKs and CLI
• Can be modified for running instances without redeployment

Cost and Compliance

• No additional cost for using instance profiles
• Helps meet compliance requirements for credential management
• Provides audit trail through CloudTrail for all API calls
• Simplifies security audits and reviews
• Reduces operational overhead for security teams