EC2 instance is associated with an IAM instance profile role

Check ID: ec2_instance_profile_attached
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: identity-access
Resource type: AwsEc2Instance

What this check verifies

EC2 instances are evaluated for association with an IAM instance profile role that delivers temporary credentials to workloads running on the instance

Risk

Without an instance profile, apps often rely on long-term access keys on the host. Exposed keys can be used from anywhere to read data, alter resources, or disrupt services, impacting confidentiality, integrity, and availability. Keys may persist in AMIs, images, or logs, hindering rotation and amplifying blast radius.

Recommendation

Attach an IAM instance profile to every instance and grant only permissions each workload requires (least privilege). Eliminate static keys on hosts; use temporary credentials with automatic rotation. Separate roles per application, enforce separation of duties, and limit who can assign roles (govern via iam:PassRole). Monitor role usage for anomalies.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 associate-iam-instance-profile --instance-id <INSTANCE_ID> --iam-instance-profile Name=<INSTANCE_PROFILE_NAME>

# Attach an IAM instance profile to the EC2 instance
resource "aws_instance" "example" {
  ami                  = "<AMI_ID>"
  instance_type        = "<INSTANCE_TYPE>"
  iam_instance_profile = "<INSTANCE_PROFILE_NAME>"  # Critical: associates an instance profile so the check passes
}

# CloudFormation: attach an IAM instance profile to the EC2 instance
Resources:
  ExampleInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <AMI_ID>
      InstanceType: <INSTANCE_TYPE>
      IamInstanceProfile: <INSTANCE_PROFILE_NAME>  # Critical: associates an instance profile so the check passes

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_profile_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires