Associate existing IAM role with EC2 instance in CloudFormation

Question

How can I use an existing IAM role for an EC2 instance, as opposed to creating a new one in my CloudFormation template?

For example, I have created a role in AWS Console and just want to use that.

Answer 1

You can use an existing InstanceProfile instead of creating a new one from within the stack. In fact, one might already be created for you - from the docs :

If you use the AWS Management Console to create a role for Amazon EC2, the console automatically creates an instance profile and gives it the same name as the role.

This means that you might not have to create an AWS::IAM::InstanceProfile resource in the stack. However note that also:

The console does not create an instance profile for a role that is not associated with Amazon EC2.

In this case you can do it manually from AWS CLI using these 2 commands:

aws iam create-instance-profile --instance-profile-name MyExistingRole
aws iam add-role-to-instance-profile --instance-profile-name MyExistingRole --role-name MyExistingRole

Then, provided you've defined a role in the UI named MyExistingRole , this will be sufficient:

"Resources" : {

  "Instance" : {
    "Type" : "AWS::EC2::Instance",
    ...
    "Properties" : {
      "IamInstanceProfile" : "MyExistingRole",
      ...
    }
  }
}

Answer 2

You need an instance profile, a role, and the instance info (or launch configuration) itself.

Your instance profile would look like this:

"Resources" : {
  "InstanceProfile" : {
    "Type" : "AWS::IAM::InstanceProfile",
    "Properties" : {
      "Path" : "/",
      "Roles" : ["MyExistingRole"]
    }
  },

  "Instance" : {
    "Type" : "AWS::EC2::Instance",
    "Properties" : {
      "IamInstanceProfile" : {"Ref" : "InstanceProfile"}
      ...
    }
  }

In particular - note that the reference in the Instance profile is to an existing RoleName

Also - I've written about bootstrapping instances which uses instance profiles and roles to ensure we're not persisting security.

The key thing is rather than using the {"Ref" : RoleName} etc, to use the actual name of the role.

Answer 3

What are you trying to do with the IAM role?

I have a cfn script that needs access to a restricted S3 bucket. My instance block looks like this - bucketName and RoleName are both parameters, with defaults:

"Resources" : {
    "myInstance" : {
        "Type" : "AWS::EC2::Instance",

        "Metadata" : {
            "Comment1" : "My Instance stuff here",     

            "AWS::CloudFormation::Authentication": {
                "default" : {
                    "type": "s3",
                    "buckets": [ { "Ref" : "bucketName" } ],
                    "roleName": { "Ref" : "RoleName" }
                }
            },
...snip...

Edit: I include the role as part of the properties when creating the instance:

        "Properties" : {
            "ImageId"             : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "64"] },
            "InstanceType"        : { "Ref" : "InstanceType" },
            "SecurityGroups"      : [ {"Ref" : "SecurityGroup"} ],
            "IamInstanceProfile"  : { "Ref" : "RoleName" },
            "KeyName"             : { "Ref" : "KeyName" },

            "BlockDeviceMappings" : [
                {
                    "DeviceName" : "/dev/sda1",
                    "Ebs" : { "VolumeSize" : "10" } 
                }
            ],

            "UserData"            : { "Fn::Base64" : { "Fn::Join" : ["", [
                "#!/bin/bash -v\n",
...snip...
            ] ] } }

And the RoleName is defined in my Parameters section:

"Parameters" : {

    "RoleName" : {
        "Description" : "Role description",
        "Type" : "String",
        "Default" : "my-default-role",
        "ConstraintDescription" : "Must be a valid IAM Role"
    }
  }

Answer 4

Just enter Existing Role name created in the Amazon console to the EC2 resource IamInstanceProfile property.

Resources:
  TestEC2Instace:
     Type: AWS::EC2::Instance
     InstanceType: t2.micro
     IamInstanceProfile: ExistingRoleName
     Tags:
       - Key: Name
         Value: Public Instance

        

Answer 5

for those using launch templates the syntax is a little different compared to ec2instance or launch configs.

below is yaml example where you are using launch templates.

LaunchTemplate:
  Properties:
    LaunchTemplateData:
      IamInstanceProfile:
        Name: !Ref ExistingInstanceProfileName