创建Boto3 EC2实例时附加角色报错求助

Hey there! I get it—when you're new to AWS and crunched for time, hitting errors while trying to attach an IAM role to an EC2 instance is super frustrating. Let's walk through the most common issues and quick fixes for your workflow (create role → create instance profile → associate role → attach to EC2):

Common Issues & Fixes #

1. Missing or Incorrect Role Trust Policy #

The #1 mistake new users make is not setting up the trust policy correctly for the IAM role. EC2 needs explicit permission to "assume" the role, otherwise it can't use it.

Correct Trust Policy Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Fix: Head to the IAM Console → Roles → Select your role → Edit Trust Policy → Paste the above (adjust if needed) and save.

2. Instance Profile Isn't Fully Synced or Associated #

After creating an instance profile and linking your role to it, AWS takes a minute to propagate this change. If you try attaching it to EC2 immediately, you might get errors like InvalidInstanceProfile.NotFound.

Fix:

• Wait 1-2 minutes for the instance profile to sync.
• Verify the association with this CLI command (replace YOUR_PROFILE_NAME):

  aws iam get-instance-profile --instance-profile-name YOUR_PROFILE_NAME
  

  Check that the Roles array includes your target role.

3. EC2 Instance Is in an Invalid State #

You can only attach IAM roles to instances that are stopped or running. If your instance is in pending, terminating, or shutting-down state, the operation will fail.

Fix: Check your EC2 instance's state in the Console or via CLI, and wait until it's in a valid state before trying again.

4. Insufficient Permissions for Your AWS User #

Your current AWS user might not have the necessary permissions to perform all the steps. You'll need at least these permissions:

• iam:CreateRole
• iam:CreateInstanceProfile
• iam:AddRoleToInstanceProfile
• ec2:AssociateIamInstanceProfile

Fix: If you're in a test environment, temporarily use an admin-level user to rule out permission issues. For production, adjust your user's IAM policy to include these actions.

5. Typos or Naming Conflicts #

It's easy to mistype the role name or instance profile name in your code. Even a small typo (like uppercase vs lowercase) will cause AWS to not recognize the resource.

Fix: Double-check all names in your code against the IAM Console. AWS resource names are case-sensitive!

If you can share the exact error message (e.g., error code or full error text), I can narrow this down even further. But these steps should cover 90% of the common issues new users run into.

内容的提问来源于stack exchange，提问作者Suman Sourav Singh