Domain expertise for granting EC2 instances secure access to AWS services using IAM roles and instance profiles. Covers the full lifecycle: identifying required permissions, creating or reusing IAM roles with least-privilege policies, creating instance profiles, attaching them to EC2 instances, and verifying credential availability.

To set up an IAM role and instance profile for an EC2 instance, follow the procedure exactly. See EC2 instance profile setup procedure.

Verify the instance ID and region are correct. List instances with .

The procedure handles replacement — it will prompt before disassociating the existing profile.

Instance profile propagation can take 30–60 seconds. Applications may need a restart to pick up new credentials.

Check that the role's policies include the required actions and resource ARNs. Review CloudTrail logs for the specific denied action.

Remove credentials from config files, environment variables (, ), and . The SDK default credential chain will then use the instance profile.