Clarification on reference versus associate instance profile (property) role

[kung]

Scenario: CloudFormation/DynamoDB/without exposing API credentials

“Launch an IAM Role that has the required permissions to read and write from the DynamoDB table. Reference the IAM Role in the instance profile property of the application instance.”

OR

“Launch an IAM Role that has the required permissions to read and write from the required DynamoDB table. Associate the Role to the application instances by referencing an instance profile.”

Please explain the difference between these 2 answers, as it is not done in the explanation.

Thanks,
Robert

[TutorialsDojo-Support]

Hi Robert,

Thank you for pointing this up.

As the two options are very similar, we will update the choices for this question to better separate the two.

Cheers,

Kenneth Samonte @ Tutorials Dojo

[MaheshGupta]

Hi Kung,

This is cloudformation related question so you need to reference the Instance Role. please see below

AWSTemplateFormatVersion: “2010-09-09”

Resources:

MyInstanceProfile:

Type: “AWS::IAM::InstanceProfile”

Properties:

Path: “/”

Roles:

–

Ref: “MyRole”