2
votes

When using the web UI for AWS Elastic Beanstalk Environment management, I see:

Code change deployments will complete faster if you associate an instance profile with this environment.

(also see this forum post mentioning the same thing: http://www.infosys.tuwien.ac.at/staff/leitner/cs_study/forum/viewtopic.php?pid=186#p186)

What is an instance profile? Why does it matter? How does it work / what is it doing?

I found these articles:

but I still don't understand instance profiles.

1
Instance profiles allow you to associate an IAM role to your instance. Does your instance need specific permissions (accessing some AWS resources...)? Does your deployment fail? - Céline Aussourd
Nothing fails; AWS just recommends associating an instance profile with the environment and I would like to have a better understanding as to what that means. - Alex Rothberg

1 Answers

5
votes

Like Celine said in the comment above, instance profiles allow you to associate an IAM role to your instance. This IAM role must be provided with certain permissions to access your AWS resources. Your EC2 instance (launched by Elastic Beanstalk) can then perform certain extra tasks. For example if you launch a worker tier environment with Elastic Beanstalk the daemon needs to poll from SQS queue, publish metrics to cloudwatch from the EC2 instance. This means that the EC2 instance needs some credentials to poll from a queue. If you have an IAM role with appropriate policies associated with the EC2 instance you essentially permit your instance to call SQS using the credentials of that role.

You can do other interesting things like automatic log publication to your S3 bucket if you have an instance profile associated with your environment. Having an instance profile allows you to control permissions you want to give to the instance and also frees you from storing long term credentials on all your EC2 instances.

From the documentation:

Instance profiles provide applications and services access to AWS resources. For example, your application may require access to DynamoDB. Every API request made to AWS services must be signed using AWS security credentials. One way to grant applications access to AWS resources is to distribute your credentials to each instance; however, distributing long-term credentials to each instance is challenging to manage and a potential security risk. Instead, you can create an IAM role with the permissions that applications require when the application makes calls to other AWS resources. When AWS Elastic Beanstalk launches the Amazon EC2 instances, it uses the instance profile associated with that role. All applications that run on the instances can use the role credentials to sign requests. Because role credentials are temporary and rotated automatically, you don't have to worry about long-term security risks.

The message you are seeing on the console regarding console is recommending you to use an instance profile because that allows your EC2 instance to take a faster path to deploy your application version each time you update your environment with a new copy of your source code. The end result is the same but having an instance profile enables optimizations in deployment speed which are not possible without one.

You can read more about instance profiles with Elastic Beanstalk here. Although you can create a custom role and associate it with a beanstalk environment by giving it appropriate permissions, you can for convenience just get a default role when you launch an environnment using the AWS console. You will have the option of choosing which role you want to associate with an environment in the create environment wizard.