Hands-On: Creating an IAM Role

Now that the wordpress user has access to the SSM parameter store, we also need to make sure that our EC2 instances can read from the SSM parameter store.

To do so, we need to define an IAM role that will be attached to our EC2 instances through the launch template.

The mechanism to attach an IAM role to an EC2 instance via a launch profile is called an IamInstanceProfile and is a field of the launch template specification.

Security implications

Doing this is a bit tricky because it has big implications on security. If we assign broad permissions to either the wordpress user or the IAM role we want to attach, it could lead to something called privilege escalation. Privilege escalation is a security issue where a user or service gains more permissions (privileges) than were originally assigned.

To avoid this, we need to make sure of the following:

• Only a specific IAM role can be assigned to our EC2 instances. In this case, it will be a new role we will create with the AmazonSSMReadOnlyAccess policy.
• Only allow the wordpress user to assign specific roles to EC2 instances, which, in this case, is the role we create in this lesson.

If we follow these two ...