Role with a trust policy

What this card says

Why do we need it?

Servers must not store access keys.

What is it?

create-role needs a trust policy that says who may assume it.

--assume-role-policy-document

How to do it

EC2 needs an instance profile holding the role.

create-instance-profile

Example

Delete order: detach, remove, then delete.