Introduction: What IAM Roles Are and Why You Need Them

AWS Identity and Access Management (IAM) roles are essential for securely managing access to your AWS resources. Unlike IAM users, which are associated with specific individuals, IAM roles are meant to be assumed by entities such as applications, services, or other AWS resources. This allows for fine-grained control over permissions, ensuring that only the necessary access is granted.

Using IAM roles helps improve security by adhering to the principle of least privilege, reducing the risk of unauthorized access. They are handy for applications running on EC2 instances, as they enable secure and temporary access to AWS resources without storing long-term credentials on the instance.

Step-by-Step Guide to Creating an IAM Role

Choosing the Right Permissions

  1. Log in to AWS Management Console: Navigate to the IAM service.
  2. To create a Role, Click “Roles” in the sidebar and then click the “Create role” button.
  3. Select Trusted Entity: Choose “AWS service” and then select “EC2” as the service that will use this role. Click “Next: Permissions”.
  4. Attach Policies: Select the appropriate policies for your use case. For example, if your EC2 instance needs to access S3, you might attach the AmazonS3ReadOnlyAccess policy. Click “Next: Tags”.

Naming and Reviewing Your Role

  1. Add Tags: Optionally, you can add tags to help identify and organize your roles.
  2. Review and Create: Provide a name for your role (e.g., EC2-S3-Access-Role). Review the permissions and click “Create role.”

Attaching the IAM Role to an EC2 Instance

Finding the IAM Role You Created

  1. Navigate to IAM Roles: In the IAM dashboard, click on “Roles” to see a list of all your IAM roles.
  2. Search for Your Role: Use the search bar to find the role you just created.

Associating the Role with the EC2 Instance

  1. Go to EC2 Dashboard: In the AWS Management Console, navigate to the EC2 service.
  2. Select Your Instance: Find and select the EC2 instance to which you want to attach the IAM role.
  3. Actions Menu: Click on the “Actions” button, then navigate to “Security” and select “Modify IAM Role”.
  4. Attach Role: In the “IAM role” dropdown, select the role you created (e.g., EC2-S3-Access-Role). Click “Update IAM role.”

Conclusion

Following these steps, you successfully created an IAM role and attached it to an EC2 instance. This lets your instance securely interact with other AWS services using temporary credentials. Utilizing IAM roles helps enhance security and manage access efficiently.

References

IAM roles for Amazon EC2

Easily Replace or Attach an IAM Role to an Existing EC2 Instance by Using the EC2 Console