terraform-aws-instance-profile

This Terraform module creates and manages AWS IAM instance profiles for EC2 instances, simplifying the process of attaching IAM roles to your instances.

Features

• Automatic SSM Integration: Enables AWS Systems Manager access by default with AmazonSSMManagedInstanceCore policy
• Custom Policy Support: Attach your own IAM policies via JSON policy documents
• Additional Policies: Attach existing AWS managed or customer managed policies
• Flexible Role Naming: Use custom role names or auto-generated names based on profile name
• Resource Tagging: Apply consistent tags across all created IAM resources
• Terraform Best Practices: Follows standard module conventions with proper outputs and variable validation

Usage example

Profile with embedded policy

First, let's prepare permissions the profile will have.

data "aws_iam_policy_document" "jumphost_permissions" {
  statement {
    actions   = ["ec2:Describe*"]
    resources = ["*"]
  }
}

Now we're ready to create the instance profile.

module "jumphost_profile" {
  source  = "infrahouse/instance-profile/aws"
  version = "1.9.0"
  
  permissions    = data.aws_iam_policy_document.jumphost_permissions.json
  profile_name   = "jumphost"
}

Profile with extra policy

Let's say we want to create the instance profile and attach an existing policy to it. This is the existing policy.

data "aws_iam_policy_document" "package-publisher" {
  statement {
    actions = [
      "s3:ListBucket",
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
    ]
    resources = [
      "arn:aws:s3:::infrahouse-release-focal/*",
      "arn:aws:s3:::infrahouse-release-jammy/*"
    ]
  }
}

resource "aws_iam_policy" "package-publisher" {
  name        = "package-publisher"
  description = "Policy that allows to publish packages"
  policy      = data.aws_iam_policy_document.package-publisher.json
}

And now we want to create the profile with the package-publisher policy attached to it.

module "jumphost_profile" {
  source  = "infrahouse/instance-profile/aws"
  version = "1.9.0"
  
  permissions    = data.aws_iam_policy_document.jumphost_permissions.json
  profile_name   = "jumphost"
  extra_policies = {
    (aws_iam_policy.package-publisher.name) : aws_iam_policy.package-publisher.arn
  }
}

Profile with custom settings

Example showing tags and disabling SSM access:

module "custom_profile" {
  source  = "infrahouse/instance-profile/aws"
  version = "1.9.0"

  permissions  = data.aws_iam_policy_document.jumphost_permissions.json
  profile_name = "custom-jumphost"
  enable_ssm   = false

  tags = {
    Environment = "production"
    Owner       = "devops-team"
    Project     = "jumphost-infrastructure"
  }
}

Profile with custom role name

Example using a specific role name instead of auto-generated one:

module "named_profile" {
  source  = "infrahouse/instance-profile/aws"
  version = "1.9.0"

  permissions  = data.aws_iam_policy_document.jumphost_permissions.json
  profile_name = "my-instance-profile"
  role_name    = "custom-ec2-role"
}

Requirements

Name	Version
aws	>= 5.11, < 7.0

Providers

Name	Version
aws	>= 5.11, < 7.0

Modules

No modules.

Resources

Name	Type
aws_iam_instance_profile.profile	resource
aws_iam_policy.profile	resource
aws_iam_role.profile	resource
aws_iam_role_policy_attachment.extra	resource
aws_iam_role_policy_attachment.profile	resource
aws_iam_role_policy_attachment.ssm	resource
aws_iam_policy.ssm	data source
aws_iam_policy_document.assume	data source

Inputs

Name	Description	Type	Default	Required
enable_ssm	Add AmazonSSMManagedInstanceCore policy to the instance role to grant an EC2 instance the minimum set of permissions needed to use AWS Systems Manager (SSM) core functionality.	bool	true	no
extra_policies	A map of additional policy ARNs to attach to the instance role	map(string)	{}	no
permissions	A JSON with a permissions policy. Note, a new policy will be created with these permissions.	any	n/a	yes
profile_name	Instance profile name.	string	n/a	yes
role_name	Profile role name. If given, it will be used. Otherwise, the profile name will be used as a name prefix.	string	null	no
tags	A map of tags to add to resources.	map	{}	no
upstream_module	Module that called this module.	string	null	no

Outputs

Name	Description
instance_profile_arn	Instance profile ARN.
instance_profile_name	Instance profile name. It's the same as the passed variable.
instance_role_arn	Role ARN that the instance gets.
instance_role_name	Role name that the instance gets.
instance_role_policy_arn	Role policy ARN that the instance gets.
instance_role_policy_attachment	aws_iam_role_policy_attachment.profile.id
instance_role_policy_name	Role policy name that the instance gets.