AutoGineer
Generated banner for Setting Up Ec2 Instance Profiles
Generated logo for Setting Up Ec2 Instance Profiles

Setting Up Ec2 Instance Profiles

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • Medium risk
Download ZIP

From the author

Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary credentials.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a standardized workflow for configuring EC2 instances to interact with AWS services securely. By replacing hardcoded credentials with IAM instance profiles, it enables instances to assume roles and retrieve temporary credentials automatically. The process covers identifying required permissions, managing IAM roles with least-privilege policies, attaching profiles to instances, and verifying the configuration.

What it does

  • Guides users through the creation or reuse of IAM roles for EC2 instances.
  • Ensures IAM roles have the correct trust policies to allow EC2 service assumption.
  • Automates the attachment of instance profiles to target EC2 instances.
  • Provides troubleshooting steps for common credential and permission issues.
  • Helps identify and remove insecure hardcoded credentials from applications.

When to use it

  • When an EC2 instance needs to access AWS services like S3, DynamoDB, or CloudWatch.
  • When you need to eliminate hardcoded AWS credentials from your application code.
  • When setting up secure, temporary credential management for cloud-hosted applications.
  • When migrating from static access keys to IAM-based authentication.

Advantages

  • Enhances security by removing the need for long-lived hardcoded credentials.
  • Reduces operational overhead by automating temporary credential rotation.
  • Ensures adherence to the principle of least privilege through role-based access.
  • Provides a clear, repeatable process for consistent cloud infrastructure configuration.

Usage examples

“I need to give my EC2 instance i-0123456789abcdef0 in us-east-1 access to S3 and DynamoDB.”
The agent will initiate the setup workflow, verify the instance, and guide you through creating or attaching an IAM role with the necessary permissions.
“How do I replace the existing IAM role on my EC2 instance with a new one?”
The agent will check the current instance profile, prompt for confirmation to replace it, and execute the update procedure safely.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/aws/setting-up-ec2-instance-profiles/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip setting-up-ec2-instance-profiles.zip -d .agents/skills

Documentation by AWS

Setting Up EC2 Instance Profiles

Overview

Domain expertise for granting EC2 instances secure access to AWS services using IAM roles and instance profiles. Covers the full lifecycle: identifying required permissions, creating or reusing IAM roles with least-privilege policies, creating instance profiles, attaching them to EC2 instances, and verifying credential availability.

Configure an EC2 instance profile

To set up an IAM role and instance profile for an EC2 instance, follow the procedure exactly. See EC2 instance profile setup procedure.

Troubleshooting

Instance not found

Verify the instance ID and region are correct. List instances with aws ec2 describe-instances --region <region>.

Instance already has a profile

The procedure handles replacement — it will prompt before disassociating the existing profile.

Credentials not available after attachment

Instance profile propagation can take 30–60 seconds. Applications may need a restart to pick up new credentials.

Access denied errors

Check that the role's policies include the required actions and resource ARNs. Review CloudTrail logs for the specific denied action.

Application still uses hardcoded credentials

Remove credentials from config files, environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), and ~/.aws/credentials. The SDK default credential chain will then use the instance profile.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Medium risk

  • References to credential files

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/ec2-skills/setting-up-ec2-instance-profiles · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS or AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download setting-up-ec2-instance-profiles.zip