setting-up-ec2-instance-profiles — Claude Code skill: how to install
Configures EC2 instance profiles and IAM roles so applications call AWS services without hardcoded credentials. Useful when an instance needs temporary access to S3, DynamoDB, or SQS.
npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a claude-codeWhat setting-up-ec2-instance-profiles does
This skill guides the setup of EC2 instance profiles and least-privilege IAM roles. It covers determining required permissions, creating or reusing IAM roles, attaching them to virtual machines, and verifying credential availability. This eliminates the risk of storing long-term credentials in code repositories or configuration files.
When an instance already has an associated profile, the procedure prompts for confirmation before disassociating it. Instance profile propagation takes 30–60 seconds across the infrastructure. Applications may need a restart to pick up the newly attached role.
If an application keeps attempting to use old credentials, remove them from ~/.aws/credentials, configuration files, and the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY variables. Once cleared, the AWS SDK credential chain falls back to the instance profile. CloudTrail logs can confirm specific denied actions during permission debugging.
What it helps with
- eliminate hardcoded AWS access keys from config files and environment variables
- attach least-privilege IAM roles to EC2 virtual machines via instance profiles
- grant applications temporary credentials for services like S3, DynamoDB, and CloudWatch
- troubleshoot permission denials by inspecting CloudTrail logs
Example prompts for the agent
- Set up an EC2 instance profile for this server to read and write to S3
- Attach an IAM role to our EC2 instance so it can push logs to CloudWatch
- Help remove static AWS access keys from this EC2 instance and switch to an IAM role
How to install setting-up-ec2-instance-profiles
1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a claude-code2Manually: put the files in place
~/.claude/skills/setting-up-ec2-instance-profiles/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/setting-up-ec2-instance-profiles/
1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a codex2Manually: put the files in place
.agents/skills/setting-up-ec2-instance-profiles/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a cursor2Manually: put the files in place
.cursor/skills/setting-up-ec2-instance-profiles/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install aws/agent-toolkit-for-aws setting-up-ec2-instance-profiles2Manually: put the files in place
.github/skills/setting-up-ec2-instance-profiles/SKILL.md1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a gemini-cli2Platform CLI
gemini skills install https://github.com/aws/agent-toolkit-for-aws --path skills/specialized-skills/ec2-skills/setting-up-ec2-instance-profilesManually: put the files in place
.devin/skills/setting-up-ec2-instance-profiles/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about setting-up-ec2-instance-profiles
How do I install setting-up-ec2-instance-profiles in Claude Code?
Run npx skills add aws/agent-toolkit-for-aws --skill setting-up-ec2-instance-profiles -a claude-code in your terminal. The skill definition is saved to ~/.claude/skills/setting-up-ec2-instance-profiles/SKILL.md.
What does setting-up-ec2-instance-profiles do?
It configures IAM roles with least-privilege policies and attaches them to EC2 instances using instance profiles, enabling secure temporary credentials for AWS services.
Why is an application still using hardcoded AWS credentials after attaching a profile?
The application finds static credentials earlier in the SDK search chain. Remove the keys from ~/.aws/credentials, configuration files, and the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.
Source text
SKILL.md · Apache-2.0
--- name: setting-up-ec2-instance-profiles description: Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary credentials. version: 1 --- # Setting Up EC2 Instance Profiles ## Overview Domain expertise for granting EC2 instances secure access to AWS services using IAM roles and instance profiles. Covers the full lifecycle: identifying required permissions, creating or reusing IAM roles with least-privilege policies, creating instance profiles, attaching them to EC2 instances, and verifying credential availability. ## Configure an EC2 instance profile To set up an IAM role and instance profile for an EC2 instance, follow the procedure exactly. See [EC2 instance profile setup procedure](references/ec2-instance-profile-setup.md). ## Troubleshooting ### Instance not found Verify the instance ID and region are correct. List instances with `aws ec2 describe-instances --region <region>`. ### Instance already has a profile The procedure handles replacement — it will prompt before disassociating the existing profile. ### Credentials not available after attachment Instance profile propagation can take 30–60 seconds. Applications may need a restart to pick up new credentials. ### Access denied errors Check that the role's policies include the required actions and resource ARNs. Review CloudTrail logs for the specific denied action. ### Application still uses hardcoded credentials Remove credentials from config files, environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), and `~/.aws/credentials`. The SDK default credential chain will then use the instance profile.
© aws · Apache-2.0 · aws/agent-toolkit-for-aws
