I would like to add a role to an existing (running?) instance. Is this possible programmatically?
It is not possible (not even in AWS dashboard). You can add an IAM role only when launching an instance
https://aws.amazon.com/iam/faqs/
Q: Can I change the IAM role on a running EC2 instance? No, at this
time you cannot change the IAM role on a running EC2 instance. You can
change the permissions on the IAM role associated with a running
instance, and the updated permissions will take effect almost
immediately.
Now you can attach a role to Running instance from Console and from CLI as well
aws ec2 associate-iam-instance-profile --instance-id *InstanceId* --iam-instance-profile Name=*NewInstanceProfileName*
Official Announcment here
You can now attach or replace an AWS Identity and Access Management
(IAM) role to your existing Amazon EC2 instance. IAM roles enable your
applications running on EC2 to use temporary security credentials that
AWS creates, distributes, and rotates automatically. Using temporary
credentials reduces the risk of long-term key compromise.
For more information. Click here
Related
I am owner of one EC2 instance. I can ssh to virtual server by key.pem. My question is to print security-group content (inbound and outbound in one page) of this EC2 instance, do I have to attach IAM role to this instance (so that I can use aws ec2 command) ?
I just wondering, if I am the owner of this instance, I shall be able to do anything without extra granting....
IAM permissions has nothing to do with EC2 instances and the owner of the instance is the AWS account. Just imagine what will happen if one of your IAM user can run any commands by just launching an instance.
You can run "aws ec2" command from your local machine/laptop after installing AWS CLI. If you choose to do so, you have to configure the CLI with the access keys of an IAM user with proper permission. Same applies to EC2 instances, but you can leverage IAM role so that you don't have to use access keys and instead use temporary credentials provided by the IAM role (recommended).
http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-quick-configuration
I've been reading up on configuring cloudwatch log service, however the docs say that you must attatch a permission to the IAM role of your instance. If I already have an instance running that doesn't have an IAM role attached, what options do I have as far as configuring this service?
You can clone your current instance into a new EC2 instance that has an IAM instance profile (role) assigned.
Stop your EC2 instance.
Create an AMI image of your EC2 instance.
Launch a new EC2 instance from your AMI image, this time assigning an IAM role.
If the instance was not launched without an IAM role, then:
Create a policy (not an inline policy) as specified in the document
Add a test IAM user and attach the policy to the test_user
From the IAM dashboard, download or copy the test_user security credentials (key and secret)
On your instance, use aws configure and configure the credentials by using the key and secret
It may look complicated but it is not.
I would like to add an IAM Role to an existing EC2 instance in AWS. I tried using AWS CLI. However, I could not find a way to do that.
As of AWS CLI v1.11.46, which was released just yesterday (see the CHANGELOG file on GitHub), you can now attach an IAM role to an existing EC2 instance that was originally launched without an IAM role using the associate-iam-instance-profile command.
You can also replace the currently attached IAM role for a running instance using replace-iam-instance-profile-association.
For more details, see the following article on AWS Security Blog:
Attach an AWS IAM Role to an Existing Amazon EC2 Instance by Using the AWS CLI.
UPDATE
As of Feb 22, 2017, you can attach/replace an IAM role to an existing EC2 instance from the EC2 console as well. See this blog post for more details.
if you are getting "The association is not the active association" error when trying to attach a role to a existing EC2 instance then you should:
1. detach the existing role from the existing EC2 instance.
2. attach a new role to the existing EC2 instance.
once you do that, you will be able to attach a role to an existing EC2 instance.
The Roles must be assigned when an instance is first launched.
It is not possible to assign the Role after the launched.
I would recommend launching a new instance via the Launch More Like This console command. Please note this will create a new boot disk based on the same AMI, so any data you've saved will not be copied across. If you wish to save the data, you will need to create an AMI from the instance and launch the new instance from that AMI.
Update Feb 2017: It is now possible to add an IAM Role to an existing instance. This can be done via the AWS Command-Line Interface (CLI). Use the replace-iam-instance-profile-association command.
Well that's the harsh truth as of now. You can't associate an IAM role to an existing instance. I came to know that when I was trying System Server Manager service which required your EC2 instance to coomunicate with ssm api.
I think we have to wait some more time.
This feature was added Feb 9 2017. Note: the thing you are looking for is called an "Instance Profile". The policy describes the rights. That policy then gets added to a role and/or instance profile. I don't see any notes about specifically how to do it so I'll add as an answer.
Source document here
Specific instructions are below to conform with StackOverflow guidelines regarding link rot.
1) Create role
aws iam create-role --role-name YourNewRole --assume-role-policy-document file://YourNewRole-Trust-Policy.json
2) Attach policy to role
aws iam attach-role-policy --role-name YourNewRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
3) Create instance profile (this is what a role is called when attached to an instance)
aws iam create-instance-profile --instance-profile-name YourNewRole-Instance-Profile
4) Add role to instance profile
aws iam add-role-to-instance-profile --role-name YourNewRole --instance-profile-name YourNewRole-Instance-Profile
5) Attach instance profile to ec2 instance
aws ec2 associate-iam-instance-profile --instance-id YourInstanceId --iam-instance-profile Name=YourNewRole-Instance-Profile
We use CloudFormation to deploy our platform. Is here a way to allow the application instance access to the DynamoDB tables without exposing API credentials?
I read about creating an IAM role that has the right permission and use instance profile. How do I achieve this? can someone please provide more details and explain what instance profile is?
As per AWS IAM documentation, Instance Profile is:
An instance profile is a container for an IAM role that you can use to pass role information to an EC2 instance when the instance starts.
So, this is a feature provided by AWS so that IAM credentials don't have to be stored in EC2 instances to execute AWS APIs. Also, this feature aids in granting only the permission specified in the desired IAM role to the EC2 instance. Also, you can use the same Instance profile on multiple instances. This way, you don't have to update credentials on each EC2 instance whenever you change the credentials. So, while launching the EC2 instance, you can specify the instance profile. The instance profile is attached to an IAM role. The EC2 instance will get the IAM role and all the IAM credentials. You just need to set the AWS region before using the APIs.
How to do it:
1) Create an IAM role using: create-role
2) Create Instance Profile using: create-instance-profile. The output of this step will contain the Arn for the Instance Profile. This needs to be used in step 4.
3) Add role to Instance Profile using: add-role-to-instance-profile
4) Launch instance using run-instances. Specify the --iam-instance-profile option as below:
--iam-instance-profile Arn=instanceArn
The instanceArn is got from step 2.
The same can be achieved using AWS Console. The Screenshot below shows, how you can specify the role during launch of an EC2 instance:
For more details please see Using Instance Profiles and section 'Permissions Required for Using Roles with Amazon EC2' at page 190 of AWS IAM User Guide.
I want to "associate an instance profile" with my environment (to speed up upload performance for my website) but can't find useful instructions on how anywhere in the AWS documentation (or here on SO).
How do I "associate an instance profile" with an environment on AWS?
Not clear what you are trying to accomplish, but if you are look to just 'associate an instance profile', here you go:
http://docs.aws.amazon.com/IAM/latest/UserGuide/instance-profiles.html
An instance profile is a container for an IAM role. Instance profiles
are used to pass role information to an Amazon EC2 instance when the
instance starts. When you use the Amazon EC2 console to launch an
instance with an IAM role, you can select a role to associate with the
instance. In the console, the list that's displayed is actually a list
of instance profile names.
If you use the AWS Management Console to create a role, the console
creates an instance profile automatically and gives it the same name
as the role it corresponds to. However, if you use the CLI, API, the
AWS SDK, or a third-party tool to create roles and instance profiles,
you create the roles and instance profiles as separate actions, and
you might give them different names. In that case, you need to know
the names of your instance profiles as well as the names of roles they
contain so that you can choose the correct instance profile when you
launch an Amazon EC2 instance.
If you are seeing this error when trying to set up a Elastic Beanstalk environment, it could be that the IAM user does not have sufficient permissions. You should add the IAM Policy named IAMFullAccess for that user.
You can check one option that works here for AWS Beanstalk. This is using AWS Console.
Create IAM Role for "EC2" as AWS Service and attach
"AWSElasticBeanstalkFullAccess" policy to it.
Create an AWS Beanstalk environment with tier/platform/application of choice. (I did with Web Tier choosing Docker platform using python:3-onbuild).
Hit "Configure More Options" > "Modify" Security.
Choose "IAM instance profile" which was created in Step 1. (Keep Service role
"aws-elasticbeanstalk-service-role" as this is needed! It has some key policies!)
"Save" and "Create Environment".
Similarly, it should work for AWS CLI and AWS SDK as well. Key here is the instance profile role you choose for EC2 (or say instance IAM role/instance profile) during Beanstalk Environment creation.
You can create customer managed policy extending or reusing AWSElasticBeanstalkFullAccess policy based on need. Refer AWSElasticBeanstalkFullAccess to understand it better. Also, check out some more AWS Managed policies starting with AWSElasticBeanStalk*.
Somehow default aws-elasticbeanstalk-ec2-role policy is not working/taking effect as desired for me.
For what it's worth, the AWS console now displays an alert (see image) that has a link to help you associate the instance profile with your environment. Therefore, if you see this message in the CLI, you probably need to log into the Management Console, navigate to Elastic Beanstalk, and choose your environment. You will then see the message and be able to use the link to resolve the issue.
Note 1: You may need to redeploy your app after associating the profile. I did.
Note 2: It really does make deployments faster.
Orome,
As E.J Brennan pointed out in his post, you must have a role created first, and attach the necessary IAM policies to that role, then you create the instance profile:
aws iam create-instance-profile --instance-profile-name YOUR_INSTANCE_PROFILE_NAME
Then add the role you created in the beginning to the instance profile:
aws iam add-role-to-instance-profile --instance-profile-name YOUR_INSTANCE_PROFILE_NAME --role-name YOUR_ROLE
Then attach the instance profile to your instance:
aws ec2 associate-iam-instance-profile --instance-id YOUR_INSTANCE_ID --iam-instance-profile Name="YOUR_INSTANCE_PROFILE_NAME"
Is this what you are looking for?
As E.J Brennan also pointed out, the AWS management console does the instance profile for you behind the scenes.