aws iam で instance proflie を設定する

instance-profile.sh

#!/bin/bash

cd $(dirname ${0})
PROFILE_NAME="test-profile"
ROLE_NAME="test-role"
POLICY_ARN="arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"

aws iam create-instance-profile --instance-profile-name ${PROFILE_NAME}
aws iam create-role --role-name ${ROLE_NAME} --assume-role-policy-document file://role.json
aws iam attach-role-policy --role-name ${ROLE_NAME} --policy-arn ${POLICY_ARN}
aws iam add-role-to-instance-profile --role-name ${ROLE_NAME} --instance-profile-name ${PROFILE_NAME}

role.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

user_policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:*ServerCertificate*",
                "iam:*InstanceProfile*",
                "iam:PassRole",
                "iam:CreateRole",
                "iam:ListInstanceProfilesForRole",
                "iam:CreatePolicy",
                "iam:AttachRolePolicy"
            ],
            "Resource": "*"
        }
    ]
}