Associate existing IAM role with EC2 instance in CloudFormation

Question

How can I use an existing IAM role for an EC2 instance, as opposed to creating a new one in my CloudFormation template?

For example, I have created a role in AWS Console and just want to use that.

Answer 1

You can use an existing InstanceProfile instead of creating a new one from within the stack. In fact, one might already be created for you - from the docs:

If you use the AWS Management Console to create a role for Amazon EC2, the console automatically creates an instance profile and gives it the same name as the role.

This means that you might not have to create an AWS::IAM::InstanceProfile resource in the stack. However note that also:

The console does not create an instance profile for a role that is not associated with Amazon EC2.

In this case you can do it manually from AWS CLI using these 2 commands:

aws iam create-instance-profile --instance-profile-name MyExistingRole
aws iam add-role-to-instance-profile --instance-profile-name MyExistingRole --role-name MyExistingRole

Then, provided you've defined a role in the UI named MyExistingRole, this will be sufficient:

"Resources" : {

  "Instance" : {
    "Type" : "AWS::EC2::Instance",
    ...
    "Properties" : {
      "IamInstanceProfile" : "MyExistingRole",
      ...
    }
  }
}

Answer 2

You need an instance profile, a role, and the instance info (or launch configuration) itself.

Your instance profile would look like this:

"Resources" : {
  "InstanceProfile" : {
    "Type" : "AWS::IAM::InstanceProfile",
    "Properties" : {
      "Path" : "/",
      "Roles" : ["MyExistingRole"]
    }
  },

  "Instance" : {
    "Type" : "AWS::EC2::Instance",
    "Properties" : {
      "IamInstanceProfile" : {"Ref" : "InstanceProfile"}
      ...
    }
  }

In particular - note that the reference in the Instance profile is to an existing RoleName

Also - I've written about bootstrapping instances which uses instance profiles and roles to ensure we're not persisting security.

The key thing is rather than using the {"Ref" : RoleName} etc, to use the actual name of the role.