EC2 instance has no IAM instance profile

What this check finds

A running EC2 instance carries no IAM instance profile. Any AWS access it needs must therefore come from credentials placed on the instance — environment variables, a config file, or baked into an AMI. Those are long-lived, do not rotate, and travel with every snapshot and image made from the host. An instance profile issues short-lived credentials that rotate automatically and can be revoked centrally.

Passing looks like: EC2 instances use IAM instance profiles.

How to fix it

Create a least-privilege role for the workload and attach it: EC2 console → select instance → Actions → Security → Modify IAM role. Then remove any static keys from the instance and from the AMI it was built from.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More EC2 checks

• HighAccount does not block public sharing of EBS snapshots
• HighAMI is publicly shared
• HighEBS snapshot is public
• HighEC2 instance CPU spiked abnormally — possible compromise or runaway process
• HighEC2 instance has an IAM role with admin privileges
• MediumAccount default for instance metadata does not require IMDSv2
• MediumEBS default encryption is not enabled for this region
• MediumEBS volume is not encrypted at rest

All EC2 checks