Attach IAM role using cloudformation

Question

I am trying to create a webserver (Ec2 instance) with an IAM role of access to S3 bucket using ccloudformation. It creates the role but doesn't attach the role to ec2-instance.

webserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: sg-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VPC
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: us-east-2a
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      KeyName: key-webserver
      NetworkInterfaces:
        - Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref SubnetA
          GroupSet:
            - Ref: webserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"

The yml file works fine. It creates an ec2-instance and security group but doesnot attach the IAM role to the ec2 Instance

Answer 1

You're not attaching it to the EC2 resource, it should instead add it via the IamInstanceProfile property of EC2.

The value should be !Ref ListS3BucketsInstanceProfile

The instance profile will never automatically attach to the instance.

webserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: sg-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VPC
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: us-east-2a
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      IamInstanceProfile: !Ref ListS3BucketsInstanceProfile
      KeyName: key-webserver
      NetworkInterfaces:
        - Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref SubnetA
          GroupSet:
            - Ref: webserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"

For more information over instance profiles take a look at this link.

Answer 2

The missing piece is the IamInstanceProfile parameter to EC2Instance. That should reference the instance profile ARN. Add the following to EC2Instance:

IamInstanceProfile: !GetAtt ListS3BucketsInstanceProfile.Arn