Create an application role for EC2 in the same AWS account. Its permissions allow only GetObject on an approved S3 prefix; other access prerequisites are met. Only the EC2 service may assume it, not people or Lambda.
Include the role in an instance profile and associate it with approved EC2 instances. The operator has iam:PassRole for this role only and the required EC2 permissions. Configure trust without broadening operating permissions.
Which trust configuration meets the requirements?
Use the role trust policy for EC2 assumption, its permissions policy for application GetObject, and operator PassRole and EC2 permissions for association.
Detailed explanation
Adding AssumeRole to the role operating permissions does not establish trust for EC2 to assume that role. Configure the service principal and action in the trust policy.
Adding AssumeRole to the role operating permissions does not establish trust for EC2 to assume that role. Configure the service principal and action in the trust policy.
Trust defines the service that can assume the role. A separate permissions policy defines subsequent GetObject actions; the instance profile and operator permissions are also required.
Trust defines the service that can assume the role. A separate permissions policy defines subsequent GetObject actions; the instance profile and operator permissions are also required.
The account root ARN delegates authority to the account. It does not identify only the EC2 service, and assumption permissions for IAM identities are evaluated separately.
The account root ARN delegates authority to the account. It does not identify only the EC2 service, and assumption permissions for IAM identities are evaluated separately.
PassRole permits the operator to pass a role to a service. It does not configure the role trust policy or the permissions for application operations on S3.
PassRole permits the operator to pass a role to a service. It does not configure the role trust policy or the permissions for application operations on S3.
Check official documentation
Compare the following points with the official documentation.
Check the test role trust and permissions policies, instance profile association, and operator PassRole scope. Use GetCallerIdentity on EC2 to verify the application role, then check approved GetObject results and unnecessary permissions.
Official references
- Official documentation 1
- Official documentation 2
- Official documentation 3
- Official documentation 4
- Official documentation 5
What to confirm
The role trusts EC2; the application uses its temporary credentials for approved GetObject. Explain why service trust, operating permissions, and role-association permissions are separate configurations.
Key points
- Trust policy
- Instance profile
- iam:PassRole
Notes
- Environment: Official IAM and EC2 documentation and approved test roles, instance profiles, and instances
- Reviewed against the linked AWS documentation on 2026-10-12.
Foundation review
Trust and operating permissions answer different questions
Effect=Allow, Principal.Service=ec2.amazonaws.com, and Action=sts:AssumeRole establish EC2 trust. Scope S3 GetObject in the role permissions policy to the required objects. Trust does not automatically authorize S3 operations, and GetObject permission does not establish EC2 trust.
Check how the role is passed to EC2
An instance profile contains the role associated with EC2. With the CLI or API, distinguish role creation, profile creation, and association. Limit operator iam:PassRole to approved role ARNs and verify EC2 action permissions. Trusting the EC2 service alone does not restrict role association to particular instances.
Verify the principal and permissions actually used
Trusting the account root ARN delegates authority to the account; it is not an EC2-only principal. Distinguish the application role from the automatically created instance identity role. Inspect the active role, profile, policies, and application outcome, troubleshooting trust, association, and operating permissions separately.