Guides

How to Attach an IAM Role to an EC2 Instance (No Access Keys)

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 29 September 2026 · Last updated: 29 September 2026

To attach an IAM role to an EC2 instance, create a role in IAM with trusted entity AWS service → EC2 and only the permissions the instance needs, then in the EC2 console select the instance → Actions → Security → Modify IAM role → choose the role → Update IAM role. The AWS CLI and SDKs on the instance then get temporary credentials automatically, with no access keys stored on the server. Check it with aws sts get-caller-identity.

aws sts get-caller-identity      # Arn: ...:assumed-role/web-s3-role/i-0123...
aws configure list               # credential type: iam-role
aws s3 ls s3://my-site-backups/

What do I need before attaching an IAM role?

• An EC2 instance with SSH access — see How to Launch an EC2 Instance and How to SSH into EC2. Amazon Linux 2023 comes with the AWS CLI installed.
• An AWS user that may create IAM roles and change EC2 instances (for example an administrator in your own lab account).
• A clear idea of what the server must do, for example "upload backups to the bucket my-site-backups". That decides the policy.

How does an IAM role give EC2 its credentials?

An IAM role is an identity with permissions but no long-term password or keys. When a role is attached to an instance (through an instance profile, which the console creates for you with the same name), AWS delivers temporary credentials to the instance through the instance metadata service at 169.254.169.254, and rotates them automatically. The AWS CLI and SDKs find them by themselves — your code needs no keys at all.

How do I attach an IAM role to an EC2 instance?

Step 1 — Create the role for EC2

IAM → Roles → Create role → Trusted entity type: AWS service → Use case: EC2 → Next.

Step 2 — Give it only the permissions it needs

Search for and tick a policy. For a quick test, AmazonS3ReadOnlyAccess works. For a real server, create your own policy that allows only the actions and the bucket it needs, for example:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:PutObject", "s3:GetObject"],
    "Resource": "arn:aws:s3:::my-site-backups/*"
  }]
}

Never attach AdministratorAccess to an application server: one bug in your code would hand an attacker the whole account.

Step 3 — Name and create the role

Role name: web-s3-role → check the trusted entity shows ec2.amazonaws.com → Create role.

Step 4 — Attach the role to the instance

EC2 → Instances → select the instance → Actions → Security → Modify IAM role → choose web-s3-role → Update IAM role. The instance keeps running; no stop or reboot is needed. For a new instance, pick the role at launch under Advanced details → IAM instance profile.

Step 5 — Verify on the instance

aws sts get-caller-identity
aws configure list
aws s3 ls s3://my-site-backups/         # read test (bucket name = yours)
echo test > t.txt && aws s3 cp t.txt s3://my-site-backups/t.txt   # write test (needs s3:PutObject)

get-caller-identity shows an ARN with assumed-role/web-s3-role/..., and aws configure list shows the type iam-role. The server now talks to AWS with no keys on disk! 🎉

How can I see the role credentials on the instance?

The metadata service shows the attached role. New instances require IMDSv2, which needs a token first:

TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/; echo

The output is the role name. You never copy these credentials anywhere — the CLI and SDKs read and refresh them for you. Keep IMDSv2 required: a plain request without a token cannot read them, which protects the role credentials from simple server-side request forgery (SSRF) bugs.

How do I fix common IAM role errors on EC2?

Ghabru naka 😅 — read the exact message: