---
title: Instance roles should be used for AWS resource access from instances
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Instance roles should be used for AWS
  resource access from instances
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Instance roles should be used for AWS resource access from instances
 
## Description{% #description %}

AWS EC2 instances should use IAM roles, delivered through an attached IAM instance profile, to access AWS resources instead of embedded credentials. IAM roles provide temporary, automatically rotated credentials, reducing the risk of credential exposure and unauthorized access. This rule fails instances that have no IAM instance profile associated, or whose instance profile contains no role. An instance profile that was not collected is not judged, and instances that are shutting down or terminated are skipped.

## Remediation{% #remediation %}

1. In the [Amazon EC2 console](https://console.aws.amazon.com/ec2/), select the instance, choose **Actions** > **Security** > **Modify IAM role**, select an existing IAM role (or create a new one), and choose **Update IAM role**.
1. Alternatively, run `aws ec2 associate-iam-instance-profile --region <region-name> --instance-id <Instance-ID> --iam-instance-profile Name=<INSTANCE_PROFILE_NAME>` and verify the association with `aws ec2 describe-instances`. Grant the role only the minimum permissions required. See [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html).

## References{% #references %}

- [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)
- [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html)
- [associate-iam-instance-profile CLI reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/associate-iam-instance-profile.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)