Setting Up Ec2 Instance Profiles

# EC2 Instance Profile Setup

## Overview

This SOP guides you through the complete process of granting an EC2 instance permissions to call AWS services securely using IAM roles and instance profiles. Instead of embedding AWS credentials in your application code, instance profiles allow EC2 instances to assume IAM roles and obtain temporary credentials automatically. This SOP helps identify required permissions, creates or uses an existing IAM role, sets up the instance profile, and attaches it to the target EC2 instance.

## Parameters

Prompt the user in a single message to provide all required parameters at once. Clearly list the required parameters and their descriptions, and include any optional parameters with their default values. Do not proceed until you have received and confirmed all required parameters. If any required parameter is missing or unclear, you MUST explicitly request the missing information before moving forward.

- **instance_id** (required): The ID of the EC2 instance to configure (e.g., "i-1234567890abcdef0")
- **region** (required): The AWS region where the instance is running (e.g., "us-east-1", "eu-west-1")
- **services_needed** (required): Comma-separated list of AWS services the instance needs to access (e.g., "s3,dynamodb,sqs", "s3,lambda,cloudwatch")
- **role_name** (optional): Name for the IAM role to create or reuse (default: "{instance_id}-role")

Only proceed to the steps below if you have all required information.

## Steps

### 1. Verify Dependencies

Check for required tools and warn the user if any are missing.

**Constraints:**

- You MUST verify the following tools are available in your context:
  - call_aws
- You MUST ONLY check for tool existence and MUST NOT attempt to run the tools because running tools during verification could cause unintended side effects, consume resources unnecessarily, or trigger actions before the user is ready
- You MUST inform the user about any missing tools with a clear message
- You MUST ask if the user wants to proceed anyway despite missing tools
- You MUST respect the user's decision to proceed or abort

### 2. Verify EC2 Instance Exists

Confirm the target EC2 instance exists and retrieve its current configuration.

**Constraints:**

- You MUST verify the instance exists using: `aws ec2 describe-instances --instance-ids ${instance_id} --region ${region}`
- You MUST check if the instance already has an IAM instance profile attached by examining the `IamInstanceProfile` field in the response
- You MUST extract the instance name from tags (if available) for better identification
- You MUST inform the user of the instance's current state (running, stopped, etc.)
- You MUST warn the user if the instance already has an instance profile attached and ask if they want to replace it
- You MUST handle the case where the instance does not exist and provide a clear error message
- You MUST retain the `describe-instances` output for reuse in later steps (e.g., to reference association IDs in Step 8)

### 3. Check for Existing IAM Role

Determine whether to create a new IAM role or reuse an existing one, then verify the selected option.

**Constraints:**

- You MUST ask the user if they want to reuse an existing IAM role or create a new one
- You MUST require the user to provide the role name if they choose to reuse an existing role and one was not already supplied
- If the user opts to create a new role, you MUST proceed to Step 4 and skip the remaining checks in this step
- If the user opts to reuse an existing role:
  - You MUST verify the role exists using: `aws iam get-role --role-name ${role_name} --region ${region}`
  - You MUST retrieve the role's trust policy to verify it allows EC2 service to assume it
  - You MUST check the trust policy contains:

    ```json
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
    ```

  - You MUST list all policies attached to the r