# Ensure EC2 instances have an IAM instance profile attached

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292202253379-ensure-ec2-instances-have-an-iam-instance-profile-attached
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon EC2 instance has an IAM instance profile (IAM role) attached. An instance profile delivers temporary, automatically rotated credentials to applications running on the instance, so that they can call AWS services without long-term access keys. Terminated instances are not evaluated.

**Rationale**

Without an instance profile, applications on the instance usually rely on long-term access keys stored on the host, in configuration files or in images. If these keys are exposed, they can be used from anywhere to read data, change resources or disrupt services, and they may remain in AMIs, snapshots or logs long after they are rotated. Attaching an IAM role with only the permissions the workload needs replaces static keys with temporary credentials and applies least privilege.

**Impact**

-   Removes the need for long-term access keys on instances
    
-   Credentials are temporary and rotated automatically
    
-   Applications that use stored access keys must be checked: the AWS SDKs and AWS CLI use explicitly configured access keys before instance profile credentials, so stored keys should be removed once the role is in place
    
-   Attaching or replacing a role does not require stopping or restarting the instance
    

**Default Value**

An EC2 instance has no IAM instance profile unless one is selected when the instance is launched or attached afterwards.

**Pre-Requisites**

-   IAM permissions: ec2:DescribeInstances, ec2:DescribeIamInstanceProfileAssociations, ec2:AssociateIamInstanceProfile, ec2:DisassociateIamInstanceProfile and iam:PassRole
    
-   An IAM role for Amazon EC2 with an instance profile and only the permissions the workload needs (iam:CreateRole, iam:CreateInstanceProfile and iam:AddRoleToInstanceProfile to create it)
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Instances**.
    
3.  Select an instance and open the **Security** tab.
    
4.  Check the **IAM Role** value.
    
5.  Repeat for each instance in each region in use.
    
6.  If an instance that is not terminated has no IAM role, follow the implementation steps.
    

**CLI:**

List the instances with their state and instance profile:

aws ec2 describe-instances --region <REGION> --query "Reservations\[\].Instances\[\].\[InstanceId,State.Name,IamInstanceProfile.Arn\]" --output table

An instance that is not terminated fails if its IamInstanceProfile value is empty (None).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Instances**.
    
3.  Select the instance found in the Test Plan.
    
4.  Choose **Actions**, **Security**, then **Modify IAM role**.
    
5.  Select the IAM role to attach.
    
6.  Choose **Update IAM role**.
    
7.  Remove any long-term access keys stored on the instance once the application uses the role.
    
8.  Repeat for each affected instance in each region in use.
    

**CLI:**

Attach the instance profile to the instance:

aws ec2 associate-iam-instance-profile --instance-id <INSTANCE\_ID> --iam-instance-profile Name=<INSTANCE\_PROFILE\_NAME>

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select the instance.
    
3.  Choose **Actions**, **Security**, then **Modify IAM role**.
    
4.  Select **No IAM Role** and choose **Update IAM role**.
    

**CLI:**

Find the association ID of the instance profile:

aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=<INSTANCE\_ID> --query "IamInstanceProfileAssociations\[\].\[AssociationId,IamInstanceProfile.Arn\]"

Remove the instance profile from the instance:

aws ec2 disassociate-iam-instance-profile --association-id <ASSOCIATION\_ID>

Note: applications that depend on the role lose access to AWS services when it is removed.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_roles\_use\_switch-role-ec2.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html)
    
-   [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ec2/associate-iam-instance-profile.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/associate-iam-instance-profile.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.