ec2-user vs root IAM instance profile change

Question

I have a CloudFormation based deployment of an application, which creates an Amazon Linux 2 EC2 instance from a Marketplace AMI with an IAM Instance Profile. In the CloudFormation template, I am running scripts via cfn-init which have some AWS CLI commands in them, like ssm get-parameter, and also am mounting an EFS volume using mount and amazon-efs-utils. This has been working like a charm.

Now I have a customer who is running in their AWS account using the common AMI and CloudFormation templates. For them, the cfn-init is failing because cfn-init is running as root, but root strangely has no IAM privileges and can't run the scripts or the efs-helper based mount, even though the Instance Profile is there. But ec2-user does have IAM privileges from the Instance Profile!

To summarize:

ec2-user does have IAM privileges from the Instance Profile.

# logged in as ec2-user
aws ssm get-parameter --name "/aParameter"

returns a result

root does not have IAM privileges from the Instance Profile.

# logged in as ec2-user
sudo aws ssm get-parameter --name "/aParameter"

An error occurred (ParameterNotFound) when calling the GetParameter operation: 

I expected that all users running in the instance would have the Instance Profile as their credentials if they have not explicitly authenticated some other way. I can't see anything in the customer's environment that would cause this - I was thinking maybe a Service Control Policy - but they have none of that.

Has anyone seen this behavior and have a fix?

Thanks so much in advance.....

Answer 1

I have no idea about the relationship between ec2-user and instance profile. ec2-user is a user on linux. instance profile is an IAM role attached to an EC2 instance. I think you can check with other commands like aws s3 ls . Btw, you are using sudo with root.

Answer 2

Turns out AWS credentials were left in the root user on the AMI. :-/

Asri Badlah's aws iam get-user suggestion showed the problem. Thank you!

The instance profile did not have access to get-user, but sudo get-user did and showed the user from the credentials in /root/.aws.