The Unholy Marriage of AWS IAM Roles and Instance Profiles

Baseline EC2 Credential Behavior

Optiv offensive cloud researcher Andre Rawls demos surprising IAM instance metadata behavior using color-coded roles/profiles on a test EC2 instance serving credentials ending in k5QD. Removing a role from its instance profile does not immediately revoke active keys—the instance keeps caching them up to six hours.

Role Swaps and Policy Mismatch

Re-adding the original role or attaching a different role (green role with explicit deny vs blue admin) does not refresh credentials promptly. After swapping green onto the blue profile, k5QD persisted ~54 minutes while still exercising blue admin powers—creating a window where displayed profile roles misrepresent effective access.

Deleted Profiles Still Serve Credentials

Detaching roles, deleting the instance profile, and even AWS console/API contradictions (profile shown attached but API 404) leave stale credentials active. Green-role denies fail while blue credentials remain usable—risky for incident responders assuming IAM changes instantly propagate.

Remediation Guidance

Disassociate deleted profiles explicitly to flush metadata credentials. Rawls stresses eventual consistency can last nearly an hour, warns burned demo accounts, and maps required IAM permissions for defenders automating cleanup.