AWS AWSEC2 documentation change
Summary
Removed verbose JSON output examples, added concrete PowerShell cmdlet implementations, and refined IAM role association/replacement/detachment procedures with specific command parameters.
Security assessment
Changes improve procedural clarity for IAM role management but do not address security vulnerabilities or introduce new security features. Focus is on command syntax and example refinement.
Diff
diff --git a/AWSEC2/latest/UserGuide/attach-iam-role.md b/AWSEC2/latest/UserGuide/attach-iam-role.md index b4c569b2d..526c8c12c 100644 --- a//AWSEC2/latest/UserGuide/attach-iam-role.md +++ b//AWSEC2/latest/UserGuide/attach-iam-role.md @@ -49,15 +48,0 @@ Use the [associate-iam-instance-profile](https://awscli.amazonaws.com/v2/documen -The following is example output. - - - { - "IamInstanceProfileAssociation": { - "InstanceId": "i-1234567890abcdef0", - "State": "associating", - "AssociationId": "iip-assoc-0dbd8529a48294120", - "IamInstanceProfile": { - "Id": "AIPAJLNLDX3AMYZNWYYAY", - "Arn": "arn:aws:iam::123456789012:instance-profile/TestRole-1" - } - } - } - @@ -69,4 +54 @@ PowerShell - * [Get-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html) - - * [Register-EC2IamInstanceProfile](https://docs.aws.amazon.com/powershell/latest/reference/items/Register-EC2IamInstanceProfile.html) - +Use the [Register-EC2IamInstanceProfile](https://docs.aws.amazon.com/powershell/latest/reference/items/Register-EC2IamInstanceProfile.html) cmdlet. @@ -74,0 +57,3 @@ PowerShell + Register-EC2IamInstanceProfile ` + -InstanceId i-1234567890abcdef0 ` + -IamInstanceProfile_Name TestRole-1 @@ -103 +88 @@ AWS CLI - 1. If required, describe your IAM instance profile associations to get the association ID for the IAM instance profile to replace. + 1. If required, use the [describe-iam-instance-profile-associations](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-iam-instance-profile-associations.html) command to get the association ID. @@ -105 +90,3 @@ AWS CLI - aws ec2 describe-iam-instance-profile-associations + aws ec2 describe-iam-instance-profile-associations \ + --filters Name=instance-id,Values=i-1234567890abcdef0 \ + --query IamInstanceProfileAssociations.AssociationId @@ -107 +94 @@ AWS CLI - 2. Use the [replace-iam-instance-profile-association](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/replace-iam-instance-profile-association.html) command to replace the IAM instance profile by specifying the association ID for the existing instance profile and the ARN or name of the instance profile that should replace it. + 2. Use the [replace-iam-instance-profile-association](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/replace-iam-instance-profile-association.html) command. Specify the association ID for the existing instance profile and the ARN or name of the new instance profile. @@ -113,14 +99,0 @@ AWS CLI -The following is example output. - - { - "IamInstanceProfileAssociation": { - "InstanceId": "i-087711ddaf98f9489", - "State": "associating", - "AssociationId": "iip-assoc-09654be48e33b91e0", - "IamInstanceProfile": { - "Id": "AIPAJCJEDKX7QYHWYK7GS", - "Arn": "arn:aws:iam::123456789012:instance-profile/TestRole-2" - } - } - } - @@ -135 +108,3 @@ PowerShell - * [Get-EC2IamInstanceProfileAssociation](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2IamInstanceProfileAssociation.html) + 1. If required, use the [Get-EC2IamInstanceProfileAssociation](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2IamInstanceProfileAssociation.html) cmdlet to get the association ID. + + (Get-EC2IamInstanceProfileAssociation -Filter @{Name="instance-id"; Values="i-0636508011d8e966a"}).AssociationId @@ -137 +112,5 @@ PowerShell - * [Set-EC2IamInstanceProfileAssociation](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-EC2IamInstanceProfileAssociation.html) + 2. Use the [Set-EC2IamInstanceProfileAssociation](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-EC2IamInstanceProfileAssociation.html) cmdlet. Specify the association ID for the existing instance profile and the ARN or name of the new instance profile. + + Set-EC2IamInstanceProfileAssociation ` + -AssociationId iip-assoc-0044d817db6c0a4ba ` + -IamInstanceProfile_Name TestRole-2 @@ -171,3 +150 @@ AWS CLI - 1. If required, use [describe-iam-instance-profile-associations](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-iam-instance-profile-associations.html) to describe your IAM instance profile associations and get the association ID for the IAM instance profile to detach. - - aws ec2 describe-iam-instance-profile-associations + 1. If required, use [describe-iam-instance-profile-associations](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-iam-instance-profile-associations.html) to get the association ID for the IAM instance profile to detach. @@ -175 +152,3 @@ AWS CLI -The following is example output. + aws ec2 describe-iam-instance-profile-associations \ + --filters Name=instance-id,Values=i-1234567890abcdef0 \ + --query IamInstanceProfileAssociations.AssociationId @@ -177,15 +156 @@ The following is example output. - { - "IamInstanceProfileAssociations": [ - { - "InstanceId": "i-088ce778fbfeb4361", - "State": "associated", - "AssociationId": "iip-assoc-0044d817db6c0a4ba", - "IamInstanceProfile": { - "Id": "AIPAJEDNCAA64SSD265D6", - "Arn": "arn:aws:iam::123456789012:instance-profile/TestRole-2" - } - } - ] - } - - 2. Use the [disassociate-iam-instance-profile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disassociate-iam-instance-profile.html) command to detach the IAM instance profile using its association ID. + 2. Use the [disassociate-iam-instance-profile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disassociate-iam-instance-profile.html) command. @@ -195,14 +159,0 @@ The following is example output. -The following is example output. - - { - "IamInstanceProfileAssociation": { - "InstanceId": "i-087711ddaf98f9489", - "State": "disassociating", - "AssociationId": "iip-assoc-0044d817db6c0a4ba", - "IamInstanceProfile": { - "Id": "AIPAJEDNCAA64SSD265D6", - "Arn": "arn:aws:iam::123456789012:instance-profile/TestRole-2" - } - } - } - @@ -217 +168,5 @@ PowerShell - * [Get-EC2IamInstanceProfileAssociation](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2IamInstanceProfileAssociation.html) + 1. If required, use [Get-EC2IamInstanceProfileAssociation](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2IamInstanceProfileAssociation.html) to get the association ID for the IAM instance profile to detach. + + (Get-EC2IamInstanceProfileAssociation -Filter @{Name="instance-id"; Values="i-0636508011d8e966a"}).AssociationId + + 2. Use the [Unregister-EC2IamInstanceProfile](https://docs.aws.amazon.com/powershell/latest/reference/items/Unregister-EC2IamInstanceProfile.html) cmdlet. @@ -219 +174 @@ PowerShell - * [Unregister-EC2IamInstanceProfile](https://docs.aws.amazon.com/powershell/latest/reference/items/Unregister-EC2IamInstanceProfile.html) + Unregister-EC2IamInstanceProfile -AssociationId iip-assoc-0044d817db6c0a4ba