Back to Checks
aws

EC2 instance is associated with an IAM instance profile role

ec2_instance_profile_attached
Service: ec2Severity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsEc2Instance

EC2 instances are evaluated for association with an IAM instance profile role that delivers temporary credentials to workloads running on the instance

Prowler logoProwlerprowler-provider-aws

Risk

Without an instance profile, apps often rely on long-term access keys on the host. Exposed keys can be used from anywhere to read data, alter resources, or disrupt services, impacting confidentiality, integrity, and availability. Keys may persist in AMIs, images, or logs, hindering rotation and amplifying blast radius.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_profile_attached

Recommendation

Attach an IAM instance profile to every instance and grant only permissions each workload requires (least privilege). Eliminate static keys on hosts; use temporary credentials with automatic rotation. Separate roles per application, enforce separation of duties, and limit who can assign roles (govern via iam:PassRole). Monitor role usage for anomalies.

Remediation

CLI

aws ec2 associate-iam-instance-profile --instance-id <INSTANCE_ID> --iam-instance-profile Name=<INSTANCE_PROFILE_NAME>

Terraform

# Attach an IAM instance profile to the EC2 instance
resource "aws_instance" "example" {
  ami                  = "<AMI_ID>"
  instance_type        = "<INSTANCE_TYPE>"
  iam_instance_profile = "<INSTANCE_PROFILE_NAME>"  # Critical: associates an instance profile so the check passes
}

NativeIaC

# CloudFormation: attach an IAM instance profile to the EC2 instance
Resources:
  ExampleInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <AMI_ID>
      InstanceType: <INSTANCE_TYPE>
      IamInstanceProfile: <INSTANCE_PROFILE_NAME>  # Critical: associates an instance profile so the check passes

Other

1Open the AWS Management Console and go to EC2
2Select Instances and choose the target instance
3Click Actions > Security > Modify IAM role
4Select the IAM role (instance profile) to attach
5Click Update IAM role

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_instance_profile_attached(Check):
    def execute(self):
        findings = []
        for instance in ec2_client.instances:
            if instance.state != "terminated":
                report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
                report.status = "FAIL"
                report.status_extended = f"EC2 Instance {instance.id} not associated with an Instance Profile Role."
                if instance.instance_profile:
                    report.status = "PASS"
                    report.status_extended = f"EC2 Instance {instance.id} associated with Instance Profile Role {instance.instance_profile['Arn']}."

                findings.append(report)

        return findings

References