# AWS instance profile - how to create in Ansible?

**URL:** <https://forum.ansible.com/t/aws-instance-profile-how-to-create-in-ansible/27517>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [May 12, 2018, 1:06am UTC](https://forum.ansible.com/t/aws-instance-profile-how-to-create-in-ansible/27517 "2018-05-12T01:06:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\
**Post date:** [May 12, 2018, 1:06am UTC](https://forum.ansible.com/t/aws-instance-profile-how-to-create-in-ansible/27517/1 "2018-05-12T01:06:07Z")

</div>

I can’t figure out how to create an instance profile.

It’s easy enough to attach an instance profile; the ec2\_lc module has an instance\_profile\_name parameter.

But how to create the policy and role?

There seem to be three relevant modules, iam, iam\_policy and iam\_role. iam\_role even has a create\_instance\_policy parameter! But each of these seems to do only part of the job.

For example, iam\_policy lets me set up an policy, but it requires a target to attach the policy to, so won’t create a standalone policy. I need a standalone policy because iam\_role requires managed policies to attach to the roles it creates. iam appears to let me create a role too, but I don’t understand most of its parameters (what the heck is a path in this context?)

**If anyone has a working example that they can share, I would be most grateful**.

By the way, what I’m trying to do is allow an instance read/write access a specific S3 bucket. I have the role and policy details I need, I just need some way to set it up in Ansible.

Many thanks, K.

---

<div class="post-metadata">

**Author:** ![flowerysong1](https://avatars.discourse-cdn.com/v4/letter/f/ecae2f/32.png) [@flowerysong1](https://forum.ansible.com/u/flowerysong1)\
**Post date:** [May 12, 2018, 2:24am UTC](https://forum.ansible.com/t/aws-instance-profile-how-to-create-in-ansible/27517/2 "2018-05-12T02:24:52Z")

</div>

> I can’t figure out how to create an instance profile.
> 
> It’s easy enough to attach an instance profile; the ec2\_lc module has an instance\_profile\_name parameter.
> 
> But how to create the policy and role?
> 
> There seem to be three relevant modules, iam, iam\_policy and iam\_role. iam\_role even has a create\_instance\_policy parameter! But each of these seems to do only part of the job.
> 
> For example, iam\_policy lets me set up an policy, but it requires a target to attach the policy to, so won’t create a standalone policy. I need a standalone policy because iam\_role requires managed policies to attach to the roles it creates. iam appears to let me create a role too, but I don’t understand most of its parameters (what the heck is a path in this context?)

The piece you appear to be missing is iam\_managed\_policy.

> **If anyone has a working example that they can share, I would be most grateful**.

`

- hosts: localhost  
become: false  
tasks:

- name: Create IAM policy for EC2 tagging  
iam\_managed\_policy:  
state: present  
policy\_name: UpdateEC2\_tags  
policy\_description: Read and update tags for EC2 resources  
policy:  
Version: ‘2012-10-17’  
Statement:

- Action: ‘ec2:CreateTags’  
Effect: Allow  
Resource: ‘\*’

- Action: ‘ec2:DescribeTags’  
Effect: Allow  
Resource: ‘\*’

- Action: ‘ec2:DeleteTags’  
Effect: Allow  
Resource: ‘\*’  
register: tagpolicy

- name: Create builder role  
iam\_role:  
name: builder  
state: present  
assume\_role\_policy\_document:  
Version : ‘2012-10-17’  
Statement:

- Effect: Allow  
Action: ‘sts:AssumeRole’  
Principal:  
Service: [ec2.amazonaws.com](http://ec2.amazonaws.com)  
managed\_policy:

- ‘arn:aws:iam::aws:policy/AmazonS3FullAccess’

- ‘arn:aws:iam::aws:policy/AmazonSNSFullAccess’

- ‘arn:aws:iam::aws:policy/AmazonRoute53FullAccess’

- “{{ tagpolicy.policy.arn }}”

`

---

<div class="post-metadata">

**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\
**Post date:** [May 13, 2018, 9:54pm UTC](https://forum.ansible.com/t/aws-instance-profile-how-to-create-in-ansible/27517/3 "2018-05-13T21:54:33Z")

</div>

Thank you!

That was indeed the missing piece, and your sample code was very useful. Thank you again.

Regards, K.