cis-aws-foundations-2-16

name	cis-aws-foundations-2.16
description	Ensure IAM instance roles are used for AWS resource access from instances
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","ec2","instance-roles","credentials","least-privilege"]
cis_id	2.16
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.14","cis-aws-foundations-2.12"]
prerequisites	[]
severity_boost	{}

Ensure IAM instance roles are used for AWS resource access from instances

Description

AWS access from within EC2 instances can be achieved either by embedding AWS access keys into applications or by assigning an IAM role to the instance with the appropriate permissions. "AWS access" refers to making API calls to AWS services to access or manage resources.

Rationale

IAM roles reduce the risks associated with storing, sharing, and rotating long-term credentials. Compromised credentials can be used outside of AWS, whereas IAM role credentials are temporary and tied to the instance.

Additionally, credentials embedded in applications or configuration files are more difficult to rotate and are more likely to be exposed over time, increasing the risk of unauthorized access.

Impact

Using embedded credentials instead of IAM roles increases the risk of credential exposure and unauthorized access, particularly if credentials are not rotated or are improperly stored.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/
2. In the left navigation panel, choose Instances
3. Select the EC2 instance you want to examine
4. Select Actions
5. Select View details
6. Review the following:

• If IAM Role contains a role, it is compliant
• If IAM Role is blank, it is non-compliant
• If an Instance profile ARN exists but no role is attached, it is non-compliant

7. Repeat for all EC2 instances

Using AWS CLI

1. List all EC2 instances:

aws ec2 describe-instances --region <region-name> --query 'Reservations[*].Instances[*].InstanceId'

2. Check for IAM instance profiles:

aws ec2 describe-instances --region <region-name> --instance-id <Instance-ID> --query 'Reservations[*].Instances[*].IamInstanceProfile'

3. If no IAM instance profile is returned, the instance does not have a role attached
4. Repeat for all instances and regions

Expected Result

Every running EC2 instance should have an IAM instance profile with an appropriate role attached. No instance should rely on embedded access keys for AWS API calls.