In AWS EC2, a machine is assigned privileges using instance profiles. Specifically:
- the desired permissions are articulated as an IAM policy,
- that policy is attached to an IAM role,
- that role is assigned to an Instance Profile,
- the Instance Profile is assigned to the new EC2 instance (often first via a Launch Template where it is accompanied with other configuration settings),
- then processes running on the instance can (using AWS SDKs) obtain credentials for the role, and use those to authorise the actions (via requests to AWS API service endpoints) permitted by the policy.
What is the purpose of the Instance Profile layer? For example, is it solely just a wrapper for a role? In other words, what is the intent behind exposing this indirection layer to the client? Particularly, why isn't the role assigned directly to the instance (in the Launch Template or the RunInstance API)?