mcpField
S
setting-up-ec2-instance-profiles

setting-up-ec2-instance-profiles

github.com/awsSecurity3.3k6.3k installsUpdated today
Repository

About setting-up-ec2-instance-profiles

A domain skill for configuring EC2 instance profiles so instances can access AWS services through IAM roles. It covers least-privilege permissions, profile attachment, credential checks, and common troubleshooting.

Key features

  1. 01Plan least-privilege IAM permissions
  2. 02Create or reuse IAM roles
  3. 03Create and attach instance profiles
  4. 04Verify credentials and troubleshoot

Use cases

  1. 01Grant an EC2 instance access to AWS services
  2. 02Replace an instance's existing profile
  3. 03Diagnose missing credentials or access denied errors

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles

After installing, type/setting-up-ec2-instance-profilesin Claude Code to confirm it loaded.

Bundled filesreferences/ec2-instance-profile-setup.md

Details

From the project README

Setting Up EC2 Instance Profiles

Overview

Domain expertise for granting EC2 instances secure access to AWS services using IAM roles and instance profiles. Covers the full lifecycle: identifying required permissions, creating or reusing IAM roles with least-privilege policies, creating instance profiles, attaching them to EC2 instances, and verifying credential availability.

Configure an EC2 instance profile

To set up an IAM role and instance profile for an EC2 instance, follow the procedure exactly. See EC2 instance profile setup procedure.

Troubleshooting

Instance not found

Verify the instance ID and region are correct. List instances with aws ec2 describe-instances --region <region>.

Instance already has a profile

The procedure handles replacement — it will prompt before disassociating the existing profile.

Credentials not available after attachment

Instance profile propagation can take 30–60 seconds. Applications may need a restart to pick up new credentials.

Access denied errors

Check that the role's policies include the required actions and resource ARNs. Review CloudTrail logs for the specific denied action.

Application still uses hardcoded credentials

Remove credentials from config files, environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), and ~/.aws/credentials. The SDK default credential chain will then use the instance profile.

Comments

Markdown supported