Creating IAM Roles and associating them with EC2 Instances in CloudFormation

bogotobogo.com site search:

IAM Role

An IAM Role consists of two parts: Permission policy and Trust policy.

The permission policy specifies the permission of the role while the trust policy describes who can assume that role.

Once the IAM Role is assumed by an allowed entiry, AWS STS (Security Token Service) provides the temporary security credentials to the entity. The temporary security credentials contain the following:

Session Token
Access Key ID
Secret Access Key
Expiration

IAM Role CloudFormation

Here is a simple template in json to create IAM Roles and associating them with EC2 Instances in CloudFormation.:

{
   "AWSTemplateFormatVersion": "2010-09-09",
   "Resources": {
      "myDummyRole": {
         "Type": "AWS::IAM::Role",
         "Properties": {
            "AssumeRolePolicyDocument": {
               "Statement": [{
                  "Effect": "Allow",
                  "Principal": {
                     "Service": ["ec2.amazonaws.com"]
                  },
                  "Action": ["sts:AssumeRole"]
               }]
            },
            "Path": "/"
         }
      },

      "myDummyInstanceProfile": {
         "Type": "AWS::IAM::InstanceProfile",
         "Properties": {
            "Path": "/",
            "Roles": [{ "Ref": "myDummyRole" }]
         }
      },

      "myDummyRolePolicies": {
         "Type": "AWS::IAM::Policy",
         "Properties": {
            "PolicyName": "myDummy",
            "PolicyDocument": {
               "Statement": [{
                  "Effect": "Allow",
                  "Action": "*",
                  "Resource": "*"
               }]
            },
            "Roles": [{ "Ref": "myDummyRole" }]
         }
      },

      "myEC2Instance": {
         "Type": "AWS::EC2::Instance",
         "Properties": {
            "ImageId": "ami-80861296",
            "InstanceType": "t2.nano",
            "Monitoring": "true",
            "DisableApiTermination": "false",
            "IamInstanceProfile": {
               "Ref": "myDummyInstanceProfile"
            }
         }
      }
   }
}

Here are the steps:

Create the AssumeRolePolicy Statement and AssumeRolePolicyDocument. We create our Statement with EC2 as the principal and AssumeRole as the action.
Create an AWS::IAM::Role for our EC2 instance, associating that role with the AssumeRolePolicyDocument.

      "myDummyRole": {
         "Type": "AWS::IAM::Role",
         "Properties": {
            "AssumeRolePolicyDocument": {
               "Statement": [{
                  "Effect": "Allow",
                  "Principal": {
                     "Service": ["ec2.amazonaws.com"]
                  },
                  "Action": ["sts:AssumeRole"]
               }]
            },
            "Path": "/"
         }
      },

Create an AWS::IAM::InstanceProfile associated with our AWS::IAM::Role.

AWS::IAM::InstanceProfile

Create a policy Statement that defines the allowed action. The role of an IAM Policy is to associate a PolicyDocument with one or more of the instance roles. In other words, there is a one-to-one mapping of an IAM Policy to a PolicyDocument but the IAM Policy can hold more than one instance role.
Put that policy Statement in a PolicyDocument. The associated PolicyDocument holds the PolicyStatement. We will see this pattern when dealing with IAM roles in CloudFormation over and over: creating standalone policy Statement that then get added to PolicyDocument. It is the PolicyDocument that is referenced by other resources.

      "myDummyRolePolicies": {
         "Type": "AWS::IAM::Policy",
         "Properties": {
            "PolicyName": "myDummy",
            "PolicyDocument": {
               "Statement": [{
                  "Effect": "Allow",
                  "Action": "*",
                  "Resource": "*"
               }]
            },
            "Roles": [{ "Ref": "myDummyRole" }]
         }
      },

Create an AWS::IAM::Policy for our PolicyDocument and associate it with all the AWS::IAM::Role, i.e., instances, that need that role.
Finally, when we create our instance resource, associate our AWS::IAM::InstanceProfile with our instance using the IamInstanceProfile property. We only specify a path. Here, we give the root path, /, but we could use the path to restrict where this policy an be applied. For each instance role we create, we need to create an InstanceProfile. There is a one-to-one mapping between instance roles and InstanceProfiles.

      "myDummyInstanceProfile": {
         "Type": "AWS::IAM::InstanceProfile",
         "Properties": {
            "Path": "/",
            "Roles": [{ "Ref": "myDummyRole" }]
         }
      },

      "myEC2Instance": {
         "Type": "AWS::EC2::Instance",
         "Properties": {
            "ImageId": "ami-80861296",
            "InstanceType": "t2.nano",
            "Monitoring": "true",
            "DisableApiTermination": "false",
            "IamInstanceProfile": {
               "Ref": "myDummyInstanceProfile"
            }
         }
      }