Description

Ensure that every Amazon EC2 instance has an IAM instance profile (IAM role) attached. An instance profile delivers temporary, automatically rotated credentials to applications running on the instance, so that they can call AWS services without long-term access keys. Terminated instances are not evaluated.

Rationale

Without an instance profile, applications on the instance usually rely on long-term access keys stored on the host, in configuration files or in images. If these keys are exposed, they can be used from anywhere to read data, change resources or disrupt services, and they may remain in AMIs, snapshots or logs long after they are rotated. Attaching an IAM role with only the permissions the workload needs replaces static keys with temporary credentials and applies least privilege.

Impact

  • Removes the need for long-term access keys on instances

  • Credentials are temporary and rotated automatically

  • Applications that use stored access keys must be checked: the AWS SDKs and AWS CLI use explicitly configured access keys before instance profile credentials, so stored keys should be removed once the role is in place

  • Attaching or replacing a role does not require stopping or restarting the instance

Default Value

An EC2 instance has no IAM instance profile unless one is selected when the instance is launched or attached afterwards.

Pre-Requisites

  • IAM permissions: ec2:DescribeInstances, ec2:DescribeIamInstanceProfileAssociations, ec2:AssociateIamInstanceProfile, ec2:DisassociateIamInstanceProfile and iam:PassRole

  • An IAM role for Amazon EC2 with an instance profile and only the permissions the workload needs (iam:CreateRole, iam:CreateInstanceProfile and iam:AddRoleToInstanceProfile to create it)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Instances.

  3. Select an instance and open the Security tab.

  4. Check the IAM Role value.

  5. Repeat for each instance in each region in use.

  6. If an instance that is not terminated has no IAM role, follow the implementation steps.

CLI:

List the instances with their state and instance profile:

aws ec2 describe-instances --region <REGION> --query "Reservations[].Instances[].[InstanceId,State.Name,IamInstanceProfile.Arn]" --output table

An instance that is not terminated fails if its IamInstanceProfile value is empty (None).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Instances.

  3. Select the instance found in the Test Plan.

  4. Choose Actions, Security, then Modify IAM role.

  5. Select the IAM role to attach.

  6. Choose Update IAM role.

  7. Remove any long-term access keys stored on the instance once the application uses the role.

  8. Repeat for each affected instance in each region in use.

CLI:

Attach the instance profile to the instance:

aws ec2 associate-iam-instance-profile --instance-id <INSTANCE_ID> --iam-instance-profile Name=<INSTANCE_PROFILE_NAME>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select the instance.

  3. Choose Actions, Security, then Modify IAM role.

  4. Select No IAM Role and choose Update IAM role.

CLI:

Find the association ID of the instance profile:

aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=<INSTANCE_ID> --query "IamInstanceProfileAssociations[].[AssociationId,IamInstanceProfile.Arn]"

Remove the instance profile from the instance:

aws ec2 disassociate-iam-instance-profile --association-id <ASSOCIATION_ID>

Note: applications that depend on the role lose access to AWS services when it is removed.

Reference