How can I use an existing IAM role for an EC2 instance, as opposed to creating a new one in my CloudFormation template?
For example, I have created a role in AWS Console and just want to use that.
You can use an existing InstanceProfile instead of creating a new one from within the stack. In fact, one might already be created for you - from the docs:
If you use the AWS Management Console to create a role for Amazon EC2, the console automatically creates an instance profile and gives it the same name as the role.
This means that you might not have to create an AWS::IAM::InstanceProfile
resource in the stack. However note that also:
The console does not create an instance profile for a role that is not associated with Amazon EC2.
In this case you can do it manually from AWS CLI using these 2 commands:
aws iam create-instance-profile --instance-profile-name MyExistingRole
aws iam add-role-to-instance-profile --instance-profile-name MyExistingRole --role-name MyExistingRole
Then, provided you've defined a role in the UI named MyExistingRole
, this will be sufficient:
"Resources" : {
"Instance" : {
"Type" : "AWS::EC2::Instance",
...
"Properties" : {
"IamInstanceProfile" : "MyExistingRole",
...
}
}
}
You need an instance profile, a role, and the instance info (or launch configuration) itself.
Your instance profile would look like this:
"Resources" : {
"InstanceProfile" : {
"Type" : "AWS::IAM::InstanceProfile",
"Properties" : {
"Path" : "/",
"Roles" : ["MyExistingRole"]
}
},
"Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"IamInstanceProfile" : {"Ref" : "InstanceProfile"}
...
}
}
In particular - note that the reference in the Instance profile is to an existing RoleName
Also - I've written about bootstrapping instances which uses instance profiles and roles to ensure we're not persisting security.
The key thing is rather than using the {"Ref" : RoleName} etc, to use the actual name of the role.
What are you trying to do with the IAM role?
I have a cfn script that needs access to a restricted S3 bucket. My instance block looks like this - bucketName and RoleName are both parameters, with defaults:
"Resources" : {
"myInstance" : {
"Type" : "AWS::EC2::Instance",
"Metadata" : {
"Comment1" : "My Instance stuff here",
"AWS::CloudFormation::Authentication": {
"default" : {
"type": "s3",
"buckets": [ { "Ref" : "bucketName" } ],
"roleName": { "Ref" : "RoleName" }
}
},
...snip...
Edit: I include the role as part of the properties when creating the instance:
"Properties" : {
"ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "64"] },
"InstanceType" : { "Ref" : "InstanceType" },
"SecurityGroups" : [ {"Ref" : "SecurityGroup"} ],
"IamInstanceProfile" : { "Ref" : "RoleName" },
"KeyName" : { "Ref" : "KeyName" },
"BlockDeviceMappings" : [
{
"DeviceName" : "/dev/sda1",
"Ebs" : { "VolumeSize" : "10" }
}
],
"UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -v\n",
...snip...
] ] } }
And the RoleName is defined in my Parameters section:
"Parameters" : {
"RoleName" : {
"Description" : "Role description",
"Type" : "String",
"Default" : "my-default-role",
"ConstraintDescription" : "Must be a valid IAM Role"
}
}