Programs on an instance often need to call AWS: read a bucket, write logs, let Systems Manager in. They should not use an access key copied onto the disk. A machine gets permissions the way Chapter 2 gave them to a service: through a role.

The role

The role's trust policy names the EC2 service as the principal, so EC2 may assume it for the instance:

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" }] }

You make it with aws iam create-role, as in Chapter 2, and give it permission policies with aws iam attach-role-policy. For Session Manager, the next lesson, that is the AWS managed policy AmazonSSMManagedInstanceCore.

The profile

An instance is not given a role directly but an instance profile, a holder with one role inside:

aws iam create-instance-profile --instance-profile-name ssm-profile

aws iam add-role-to-instance-profile --instance-profile-name ssm-profile --role-name ssm-role

Attaching it

aws ec2 associate-iam-instance-profile --instance-id $ID --iam-instance-profile Name=ssm-profile

From now on the instance receives the role's temporary credentials, renewed before they expire. Nothing secret is stored on it, and the permissions can change without touching the machine.