How do I remove a role from an EC2 instance?

Question

I launched an instance with an iam role

I now want to remove the role from the instance via powershell

I must be confused about the terminology here because I'm reading this doc and I don't see how to remove a role from an instance.

I want to run this command on the EC2 instance that the role will be removed from.

There can only be one role assigned to an instance so is there a way to dynamically get the iam role that has been assigned to an instance and remove it from the instance via the powershell api?

Answer 1

You can do that using AWS CLI (v1.11.46 or newer). You can disassociate an IAM instance profile from a running or stopped instance using the disassociate-iam-instance-profile command.

For more details, see the disassociate-iam-instance-profile CLI command documentation.

Answer 2

You cannot change (add or remove) IAM Roles on an instance once it has been created. This is a limitation of the EC2 service and is the same no matter which CLI you use so it isn't just powershell that cannot do this.

You have to re-create the instance with new roles if you want to change them.

Answer 3

Adding and changing Roles on EC2 instances is now (early 2017) supported via the CLI or Console.

You can just remove a role via the CLI remove-role-from-instance-profile or via the console by replacing the old with the offered "No Role" option.