EC2 instance is associated with an IAM instance profile role
ec2_instance_profile_attached
EC2 instances are evaluated for association with an IAM instance profile role that delivers temporary credentials to workloads running on the instance
Risk
Without an instance profile, apps often rely on long-term access keys on the host. Exposed keys can be used from anywhere to read data, alter resources, or disrupt services, impacting confidentiality, integrity, and availability. Keys may persist in AMIs, images, or logs, hindering rotation and amplifying blast radius.
prowler aws --checks ec2_instance_profile_attached
Recommendation
Attach an IAM instance profile to every instance and grant only permissions each workload requires (least privilege). Eliminate static keys on hosts; use temporary credentials with automatic rotation. Separate roles per application, enforce separation of duties, and limit who can assign roles (govern via iam:PassRole). Monitor role usage for anomalies.
Remediation
aws ec2 associate-iam-instance-profile --instance-id <INSTANCE_ID> --iam-instance-profile Name=<INSTANCE_PROFILE_NAME>
- Open the AWS Management Console and go to EC2
- Select Instances and choose the target instance
- Click Actions > Security > Modify IAM role
- Select the IAM role (instance profile) to attach
- Click Update IAM role
Source Code
Resource Type
AwsEc2Instance