Project: KICS (Provisioning / Security & Compliance)
File: f914357d-8386-4d56-9ba6-456e5723f9a6.md

title: EC2 Instance Has No IAM Role hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f914357d-8386-4d56-9ba6-456e5723f9a6 Query name: EC2 Instance Has No IAM Role Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Check if an EC2 instance refers to an IAM profile, which represents an IAM Role.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4 29 55" Resources: NoIAM: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName Tags: Key: Name Value: Test IAM_Missing: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName IamInstanceProfile: Ref: NonExistantProfile SecurityGroupIds: Ref: SSHAccessSG Tags: Key: Name Value: Test IAMNoRoles: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName IamInstanceProfile: Ref: NoRolesProfile Tags: Key: Name Value: Test NoRolesProfile: Type: AWS::IAM::InstanceProfile Properties: Path: "/" ``` ```json title="Positive test num. 2 - json file" hl_lines="5 94 47" { "Resources": { "NoIAM": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": { "Ref": "InstanceType" }, "ImageId": { "Fn::FindInMap": [ "AMIs", { "Ref": "AWS::Region" }, "Name" ] }, "KeyName": { "Ref": "KeyName" }, "Tags": [ { "Key": "Name", "Value": "Test" } ] } }, "IAM_Missing": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": { "Ref": "InstanceType" }, "ImageId": { "Fn::FindInMap": [ "AMIs", { "Ref": "AWS::Region" }, "Name" ] }, "KeyName": { "Ref": "KeyName" }, "IamInstanceProfile": { "Ref": "NoProfile" }, "SecurityGroupIds": [ { "Ref": "SSHAccessSG" } ], "Tags": [ { "Key": "Name", "Value": "Test" } ] } }, "IAMNoRoles": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": { "Ref": "InstanceType" }, "ImageId": { "Fn::FindInMap": [ "AMIs", { "Ref": "AWS::Region" }, "Name" ] }, "KeyName": { "Ref": "KeyName" }, "IamInstanceProfile": { "Ref": "NoRolesProfile" }, "Tags": [ { "Key": "Name", "Value": "Test" } ] } }, "NoRolesProfile": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Path": "/" } } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="29 4 53" Resources: NoIAM: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName Tags: Key: Name Value: Test IAM_Missing: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName IamInstanceProfile: NonExistantProfile SecurityGroupIds: Ref: SSHAccessSG Tags: Key: Name Value: Test IAMNoRoles: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName IamInstanceProfile: NoRolesProfile Tags: Key: Name Value: Test NoRolesProfile: Type: AWS::IAM::InstanceProfile Properties: Path: "/" ``` ```yaml title="Negative test num. 1 - yaml file" Resources: Test: Type: AWS::EC2::Instance Properties: InstanceType: Ref: InstanceType ImageId: Fn::FindInMap: AMIs Ref: AWS::Region Name KeyName: Ref: KeyName IamInstanceProfile: Ref: ListS3BucketsInstanceProfile SecurityGroupIds: Ref: SSHAccessSG Tags: Key: Name Value: Test ListS3BucketsInstanceProfile: Type: AWS::IAM::InstanceProfile Properties: Path: "/" Roles: Ref: ListS3BucketsRole ListS3BucketsRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Principal: Service: ec2.amazonaws.com Action: sts:AssumeRole Path: "/" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "Test": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": { "Ref": "InstanceType" }, "ImageId": { "Fn::FindInMap": [ "AMIs", { "Ref": "AWS::Region" }, "Name" ] }, "KeyName": { "Ref": "KeyName" }, "IamInstanceProfile": { "Ref": "ListS3BucketsInstanceProfile" }, "SecurityGroupIds": [ { "Ref": "SSHAccessSG" } ], "Tags": [ { "Key": "Name", "Value": "Test" } ] } }, "ListS3BucketsInstanceProfile": { "Properties": { "Path": "/", "Roles": [ { "Ref": "ListS3BucketsRole" } ] }, "Type": "AWS::IAM::InstanceProfile" }, "ListS3BucketsRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/" } } } } ```