Lesson 05 — IAM Roles for EC2

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand why IAM Roles are required for EC2.
Explain how IAM Roles work.
Understand Instance Profiles.
Attach IAM Roles to EC2 instances.
Verify temporary AWS credentials.
Apply enterprise least privilege principles.
Eliminate the use of AWS Access Keys on servers.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Intermediate

Prerequisites: Lesson 04 – Launching Secure EC2 Instances

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies has deployed its application servers into private subnets.

The developers now need the application to:

Read files from Amazon S3
Send logs to CloudWatch
Retrieve secrets from AWS Secrets Manager
Register with AWS Systems Manager

A developer suggests storing the following credentials inside the application:

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY

The Cloud Security team immediately rejects this approach.

Instead, they require every EC2 instance to authenticate using an IAM Role.

🚨 Why Access Keys Are Dangerous

Imagine storing AWS Access Keys inside a server.

Application

↓

AWS Access Keys

↓

Amazon S3

If an attacker compromises the server, they may steal those credentials and access AWS resources.

Risks include:

Data theft
Resource deletion
Cryptocurrency mining
Privilege escalation
Financial loss

Long-term credentials should never be stored on EC2 instances.

✅ The Secure Solution

AWS provides IAM Roles.

Instead of storing credentials on the server, AWS automatically provides temporary credentials to the EC2 instance.

EC2 Instance

↓

IAM Role

↓

Temporary Credentials

↓

Amazon S3

No passwords or access keys are stored on the server.

🤔 What is an IAM Role?

An IAM Role is an AWS identity that grants permissions without requiring permanent credentials.

Unlike an IAM User:

A Role has no password.
A Role has no long-term Access Keys.
Temporary credentials are generated automatically.

Roles are assumed by trusted AWS services such as:

Amazon EC2
AWS Lambda
Amazon ECS
Amazon EKS
AWS CloudFormation

IAM User vs IAM Role

IAM User	IAM Role
Long-term credentials	Temporary credentials
Passwords	No password
Access Keys	No permanent keys
Used by people	Used by AWS services and applications
Manual credential management	Automatic credential rotation

For EC2, IAM Roles are the recommended approach.

🏗 How IAM Roles Work

                EC2 Instance
                      │
               IAM Instance Profile
                      │
                 IAM Role
                      │
           AWS Security Token Service (STS)
                      │
          Temporary Security Credentials
                      │
        Amazon S3 / CloudWatch / Secrets Manager

AWS Security Token Service (STS) issues temporary credentials to the EC2 instance.

These credentials are automatically rotated by AWS.

What is an Instance Profile?

An Instance Profile is a container that allows an IAM Role to be attached to an EC2 instance.

Think of it as the bridge between EC2 and IAM.

EC2 Instance

↓

Instance Profile

↓

IAM Role

↓

AWS Services

When you attach an IAM Role in the EC2 console, AWS automatically uses the corresponding Instance Profile.

CloudNova Architecture

                 Private EC2 Instance
                        │
                  IAM Instance Profile
                        │
                 CloudNova-EC2-Role
                        │
     ┌──────────────┬──────────────┬──────────────┐
     │              │              │
 Amazon S3     CloudWatch     Systems Manager

No AWS Access Keys are stored on the server.

Principle of Least Privilege

CloudNova follows the Principle of Least Privilege.

Grant only the permissions required.

❌ Bad Example

AdministratorAccess

✅ Better Example

AmazonS3ReadOnlyAccess

✅ Even Better

Read only

Specific S3 Bucket

Specific Prefix

Always grant the minimum permissions needed.

🛠 Lab 01 — Create an IAM Role

Open:

AWS Console

↓

IAM

↓

Roles

↓

Create Role

Select:

Trusted Entity

↓

AWS Service

↓

EC2

Click:

Next

Step 2 — Attach Permissions

Attach the following AWS managed policies:

AmazonSSMManagedInstanceCore

CloudWatchAgentServerPolicy

AmazonS3ReadOnlyAccess

These permissions allow the instance to:

Register with Systems Manager.
Publish CloudWatch metrics.
Read data from Amazon S3.

Click:

Next

Step 3 — Name the Role

Example:

CloudNova-EC2-Role

Review the configuration and click:

Create Role

🛠 Lab 02 — Attach the IAM Role

Navigate to:

EC2

↓

Instances

↓

CloudNova-App-Server-01

Choose:

Actions

↓

Security

↓

Modify IAM Role

Select:

CloudNova-EC2-Role

Click:

Update IAM Role

🛠 Lab 03 — Verify the IAM Role

Connect to the EC2 instance using Session Manager or SSH.

Run:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

Expected output:

CloudNova-EC2-Role

Now retrieve the temporary credentials:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/CloudNova-EC2-Role

You should see JSON similar to:

{
  "AccessKeyId": "...",
  "SecretAccessKey": "...",
  "Token": "...",
  "Expiration": "..."
}

These credentials are temporary and managed automatically by AWS.

🛠 Lab 04 — Test S3 Access

Run:

aws s3 ls

If the IAM Role has the required permissions, the command should successfully list accessible S3 buckets.

No access keys are required.

🛠 Lab 05 — Verify Your Identity

Run:

aws sts get-caller-identity

Example output:

{
  "UserId": "...",
  "Account": "123456789012",
  "Arn": "arn:aws:sts::123456789012:assumed-role/CloudNova-EC2-Role/..."
}

Notice that the identity is an assumed IAM Role, not an IAM User.

💻 AWS CLI Lab

Create an IAM Role

aws iam create-role \
    --role-name CloudNova-EC2-Role \
    --assume-role-policy-document file://trust-policy.json

Attach a Managed Policy

aws iam attach-role-policy \
    --role-name CloudNova-EC2-Role \
    --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

List IAM Roles

aws iam list-roles

Describe an IAM Role

aws iam get-role \
    --role-name CloudNova-EC2-Role

Verify the Caller Identity

aws sts get-caller-identity

✅ Verification

Confirm:

✔ IAM Role attached to the EC2 instance.

✔ No AWS Access Keys stored locally.

✔ Temporary credentials available through the Instance Metadata Service.

✔ aws s3 ls works successfully.

✔ aws sts get-caller-identity returns an assumed-role ARN.

🔍 Troubleshooting

Problem

aws s3 ls returns AccessDenied.

Check:

IAM policy permissions.
S3 bucket policy.
Correct IAM Role attached.

Problem

No IAM Role visible.

Verify:

Instance Profile attached.
EC2 instance refreshed after attaching the role.

Problem

Metadata request fails.

Check:

IMDS is enabled.
Security configuration allows access to the Instance Metadata Service.
You’re using the correct metadata path.

Problem

Temporary credentials not returned.

Verify:

IAM Role exists.
Trust relationship allows EC2 to assume the role.
Instance Profile is correctly associated.

🏢 Enterprise Best Practices

CloudNova standards:

Never store AWS Access Keys on EC2 instances.
Use IAM Roles for all AWS service access.
Apply the Principle of Least Privilege.
Prefer custom IAM policies over broad managed policies where practical.
Regularly review IAM permissions.
Monitor IAM activity using CloudTrail.
Remove unused roles and policies.

🚫 Common Mistakes

❌ Storing AWS Access Keys in application code.

❌ Granting AdministratorAccess to EC2 instances.

❌ Using one IAM Role for every server.

❌ Forgetting to review IAM permissions.

❌ Ignoring trust relationships.

❌ Not validating the permissions granted to the role.

🧪 DIY Challenge

Create a new IAM Role named:

CloudNova-App-Role

Requirements:

Trusted entity: EC2
Permissions:
- AmazonSSMManagedInstanceCore
- CloudWatchAgentServerPolicy
- Read-only access to a specific S3 bucket (create a custom policy if available)

Attach the role to a test EC2 instance.

Verify:

aws sts get-caller-identity
aws s3 ls
IAM Role appears in the EC2 console.
No AWS Access Keys are stored on the server.

Take screenshots of:

IAM Role
Attached Policies
EC2 IAM Role configuration
AWS CLI outputs

📊 Knowledge Check

What is an IAM Role?
Why are IAM Roles preferred over AWS Access Keys on EC2?
What is an Instance Profile?
Which AWS service provides temporary credentials to IAM Roles?
What does the Principle of Least Privilege mean?
Which command verifies the IAM identity of an EC2 instance?
Why should applications avoid storing AWS credentials?
What is the purpose of the trust relationship in an IAM Role?
How are IAM Roles attached to EC2 instances?
How do temporary credentials improve security?

💡 Key Takeaways

After completing this lesson, you should understand:

IAM Roles provide secure, temporary AWS credentials to EC2 instances without storing long-term access keys.
Instance Profiles allow IAM Roles to be associated with EC2 instances.
AWS Security Token Service (STS) automatically issues and rotates temporary credentials.
Applying the Principle of Least Privilege reduces the impact of compromised workloads.
IAM Roles are a fundamental security control for production AWS environments and should be used whenever EC2 instances need to access AWS services.

🚀 Next Lesson

➡️ Lesson 06 — Amazon EBS Encryption & AMIs