iam_instance_profile behavior when creating aws_instance

[hashibot]

This issue was originally opened by @schmidlop as hashicorp/terraform#16374. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.10.7

Terraform Configuration Files

resource "aws_instance" "just-docker" {
  ami             = "${data.aws_ami.just-docker-ami.id}"
  instance_type   = "t2.micro"
  key_name        = "aws_terraform_deployment_key"
  iam_instance_profile = "S3DockerImageAccess"
  tags = {
    Name = "just-docker"
  }
}

Expected Behavior

I was expecting the IAM role corresponding to the iam_instance_profile to be assigned to the instance.

Actual Behavior

terraform apply failed with message:
Error launching source instance: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message:...

Steps to Reproduce

1. terraform init
2. terraform apply

Important Factoids

My credentials are in ~/.aws/credentials
The IAM Role does not have permissions to create EC2 instances.
The IAM role grants permissions to read and write a specific s3 bucket to be used as storage for docker registry.
Seems the role is being used to create the instance, rather than my AWS credentials. If I remove the iam_instance_profile attribute - everything is fine except the resulting ec2 instance is not assigned a IAM Role.

Seems like there should be a way to assign an IAM Role to an instance that doesn't have full permissions to EC2...

[bflad]

The instance profile you pass to the aws_instance does not have to do with creating and running the instance itself. It is permissions granted to the running instance to access other resources.

Shots in the dark here:

• does your IAM user have iam:PassRole permissions to the S3DockerImageAccess IAM role?
• Does the S3DockerImageAccess IAM role assume role policy (trusted relationships in the UI) allow ec2.amazonaws.com?

[schmidlop]

Thank you!iam:PassRole was the problem. These links were helpful:

• AWS docs: Permissions Required for Using Roles with Amazon EC2
• Server Fault: How to specify an IAM role for an Amazon EC2 instance

[bflad]

I created #2207 to update the aws_instance resource iam_instance_profile documentation.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!