Hands-On: Creating an IAM Role

Now that the wordpress user has access to the SSM parameter store, we also need to make sure that our EC2 instances can read from the SSM parameter store.

To do so, we need to define an IAM role that will be attached to our EC2 instances through the launch template.

The mechanism to attach an IAM role to an EC2 instance via a launch profile is called an IamInstanceProfile and is a field of the launch template specification.

Security implications

Doing this is a bit tricky because it has big implications on security. If we assign broad permissions to either the wordpress user or the IAM role we want to attach, it could lead to something called privilege escalation. Privilege escalation is a security issue where a user or service gains more permissions (privileges) than were originally assigned.