Description

Amazon EC2 enables you to share your AMIs with other AWS accounts. You can allow all AWS accounts to launch the AMI (make the AMI public), or only allow a few specific accounts to launch the AMI (see Sharing an AMI with Specific AWS Accounts). You are not billed when your AMI is launched by other AWS accounts; only the accounts launching the AMI are billed.


Rationale:  

Instance Profile needs to be attached for EC2 instances which are internet facing


Remediation:

Steps to to attach or replace an instance profile on an EC2 instance using AWS Management Console

  1. Open the Amazon EC2 console, and then choose Instances.
  2. Choose the instance that you want to attach an IAM role to.
  3. Check the IAM role under the Description view of the Launch Instance pane to confirm if an IAM role is attached to the Amazon EC2 instance. If an IAM role is attached, be sure that changing the role attached to this Amazon EC2 instance doesn't affect your applications or access to AWS services.
  4. Choose Actions, choose Instance Settings, and then choose Attach/Replace IAM role.
  5. On the Attach/Replace IAM role page, under IAM role, choose the instance profile that you want to attach from the drop-down list.
  6. Choose Apply.


Reference:

    https://aws.amazon.com/premiumsupport/knowledge-center/attach-replace-ec2-instance-profile/