Scenario

Your team needs an EC2 instance to manage IAM resources programmatically. To follow AWS security best practices, you should use an IAM role instead of embedding credentials.

Task

Create an IAM role named IAMFullAccessEC2 that:

• Allows the EC2 service to assume the role
• Has the IAMFullAccess AWS managed policy attached

Note: You can use either the AWS Management Console or AWS CLI to complete this task.

Step 1: Create a trust policy for EC2

Create a file called trust-policy.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Step 2: Create the IAM role with the trust policy

aws iam create-role \
  --role-name IAMFullAccessEC2 \
  --assume-role-policy-document file://trust-policy.json

Creates the role and specifies that EC2 instances can assume it.

Step 3: Attach the IAMFullAccess managed policy

aws iam attach-role-policy \
  --role-name IAMFullAccessEC2 \
  --policy-arn arn:aws:iam::aws:policy/IAMFullAccess

Grants full IAM access permissions to the role.

Step 4: Verify the role was created

aws iam list-roles --query "Roles[?RoleName=='IAMFullAccessEC2']"

Lists roles filtered by name to confirm the role exists with the correct configuration.