使用Boto3调用client.associate_iam_instance_profile时遭遇无效IAM Instance Profile ARN错误

I’ve run into this exact frustrating issue before—you verify the instance profile exists, but the ARN still gets flagged as invalid when trying to associate it with an EC2 instance. Let’s walk through the most common fixes that should resolve this:

• Double-check your AWS account ID in the ARN
  The ARN you provided uses 1234556, but AWS account IDs are always 12-digit numbers. It looks like you’re missing several digits here. Even if the instance profile name is correct, a truncated or wrong account ID will make the ARN invalid. Grab your full 12-digit account ID from the AWS console (under your account dropdown) and update the ARN accordingly.

• Fetch the exact ARN from AWS instead of typing it manually
  Manual typos are easy to miss. Get the precise ARN for your instance profile using either the IAM console or AWS CLI:

  • Console: Navigate to IAM → Instance Profiles → Select test-instance-profile → Copy the ARN from the summary section.
  • CLI: Run this command and copy the Arn value from the output:

    aws iam get-instance-profile --instance-profile-name test-instance-profile
    

  Replace the ARN in your code with this copied value to eliminate any spelling or formatting errors.

• Ensure your SDK client is targeting the correct region
  While IAM is a global service, the EC2 AssociateIamInstanceProfile API is region-specific. If your SDK client is configured for a different region than where your EC2 instance resides, this can lead to unexpected "invalid ARN" errors. Double-check that your client’s region matches the instance’s region (e.g., if the instance is in us-east-1, make sure your client is initialized with that region).

• Verify the EC2 instance is in a valid state
  The instance needs to be in either running or stopped state to associate an instance profile. If it’s in pending, terminating, or another transitional state, the API call might fail with a misleading error message. Wait for the instance to stabilize before trying the association again.

• Check your IAM permissions
  Sometimes AWS returns ARN validation errors when the real issue is insufficient permissions. Make sure the IAM identity running your code has:

  • ec2:AssociateIamInstanceProfile permission (to link the profile to the instance)
  • iam:PassRole permission for the role attached to your instance profile (this allows EC2 to assume the role on your behalf)

Here’s how your corrected code might look once you have the proper ARN:

client.associate_iam_instance_profile(
    IamInstanceProfile={
        'Arn': 'arn:aws:iam::123456789012:instance-profile/test-instance-profile'
    },
    InstanceId=instance_id
)

内容的提问来源于stack exchange，提问作者mwaks