Why does AWS wrap roles with instance profiles?

Question

In AWS EC2, a machine is assigned privileges using instance profiles. Specifically:

• the desired permissions are articulated as an IAM policy,
• that policy is attached to an IAM role,
• that role is assigned to an Instance Profile,
• the Instance Profile is assigned to the new EC2 instance (often first via a Launch Template where it is accompanied with other configuration settings),
• then processes running on the instance can (using AWS SDKs) obtain credentials for the role, and use those to authorise the actions (via requests to AWS API service endpoints) permitted by the policy.

What is the purpose of the Instance Profile layer? For example, is it solely just a wrapper for a role? In other words, what is the intent behind exposing this indirection layer to the client? Particularly, why isn't the role assigned directly to the instance (in the Launch Template or the RunInstance API)?

Answer 1

The data structures involved with EC2 and IAM are almost as old as EC2 itself. I don't know the definitive answer because I didn't work at AWS when these were built, but it was most probably a kludge and maybe future-proofing.

Many of the newer services that are built today, for example Lambda, don't need this kludge anymore and can link IAM Roles directly to the Lambda function.

Since for the most part, AWS try and keep existing APIs and not break them. This EC2 IAM Profile thing is unlikely to change.