KodeKloud Notes

Welcome! In this guide, we cover how to use IAM roles to securely grant permissions to your EC2 instances without embedding long-term access keys.

Why You Need IAM Roles

Managing static AWS access keys on EC2 instances poses several operational and security challenges:

Securely provisioning credentials to every new instance.
Rotating keys when they expire or are compromised.
Preventing API request failures due to missing or revoked keys.

The image is a diagram showing AWS Cloud components, including storage and processing instances, with connections indicating interactions between them. It features spot and auto-scaled instances.

Static credentials don’t scale in dynamic environments. IAM roles deliver temporary credentials automatically, solving distribution and rotation issues.

Note

Instances with IAM roles receive short-lived credentials from the metadata service. This eliminates the need to store access keys on disk.

What Is an IAM Role?

An IAM role is an AWS identity with attached permissions defined by IAM policies. Unlike an IAM user, a role:

Isn’t tied to a specific individual.
Has no long-term credentials (no static keys or passwords).
Can be assumed by authorized entities (EC2, Lambda, ECS, etc.).

When you launch an EC2 instance, attach a role—and AWS will provision temporary credentials (AccessKeyId, SecretAccessKey, Token) via the instance metadata service.

The image illustrates the working of an AWS IAM role, showing a flow from a document icon to various AWS service icons, including a bucket and other service symbols.

EC2 Instance Metadata Service

EC2 instance metadata provides instance information and temporary credentials at a fixed IP address. To list all metadata categories:

curl http://169.254.169.254/latest/meta-data/

Sample output:

ami-id/
instance-id/
iam/
instance-action/

Warning

Enable and enforce IMDSv2 on your instances to protect against SSRF attacks. See AWS IMDSv2 documentation.

Retrieving Temporary Credentials

Assuming your role is named s3access, fetch credentials with:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/s3access

Example response:

{
  "Code" : "Success",
  "LastUpdated" : "2023-06-15T12:00:00Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIAEXAMPLE",
  "SecretAccessKey" : "wJalrExampleKEY",
  "Token" : "IQoJb3JpZ2luX2VjExampleToken",
  "Expiration" : "2023-06-15T18:00:00Z"
}

These credentials expire automatically and cannot be reused elsewhere.

Using AWS CLI with IAM Roles

With the IAM role attached, the AWS CLI handles credential retrieval and signing transparently. For example, list an S3 bucket:

aws s3 ls s3://example-bucket

Under the hood:

CLI requests temporary credentials from the metadata service.
It uses those credentials to sign API calls.
Results (e.g., bucket contents) are returned.

The image is a diagram illustrating the relationship between AWS EC2 instances and IAM roles, featuring icons representing AWS services like S3 and IAM.

Best Practices

Practice	Recommendation
Use IAM Roles	Avoid embedding keys; assign minimal privileges to roles.
Enforce IMDSv2	Require session tokens and mitigate SSRF risks.
Rotate Policies	Update IAM policies regularly to follow least-privilege principles.
Monitor with CloudTrail	Track IAM role assumptions and API calls for auditing and compliance.

Summary

IAM roles provide temporary, auto-rotated credentials scoped to your EC2 instances.
A single EC2 instance can hold one IAM role, while a role can attach to multiple instances.
AWS SDKs, CLI, and tools automatically retrieve metadata credentials without manual intervention.

The image is a summary of EC2 IAM roles, highlighting that IAM role credentials are temporary, work only from EC2 instances, an EC2 instance is attached to a single role, and a role can be attached to multiple EC2 instances.

EC2 Instance and IAM role