The API server api-1wmyomc is running. It needs to read the market's catalogue from S3, and nobody wants an access key on its disk. A trust policy naming the EC2 service is in ~/ec2-trust.json.

1. Create a role named catalog-reader-1wmyomc that EC2 may assume.
2. Let the role read S3 and do nothing else, with the AWS managed policy AmazonS3ReadOnlyAccess.
3. Create an instance profile named catalog-profile-1wmyomc and put the role in it.
4. Attach the profile to api-1wmyomc.