> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/infrastructure-security-70/switch-from-one-iam-role-to-another.md).

# Switch from one IAM role to another

* Using **roles to grant permissions to applications that run on EC2 instances requires a bit of extra configuration**.<br>
* An **application running on an EC2 instance is abstracted from AWS by the virtualized operating system**.
  * Because of this extra separation, an **instance profile is needed to assign an AWS role and its associated permissions to an EC2 instance** and make them available to its applications.<br>
* The **instance profile contains the role and can provide the role's temporary credentials to an application that runs on the instance**.
  * Those **temporary credentials can then be used in the application's API calls to access resources and to limit access** to only those resources that the role specifies.<br>
* **Only one role can be assigned to an EC2 instance at a time**, and all applications on the instance share the same role and permissions.

![](https://560082743-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MT1aTjM0U73ienXQ-F0%2F-MTRmYlTi8e7OVwHL436%2F-MTS_qgLugknTZYHzrPR%2Fimage.png?alt=media\&token=0515eb98-c8e9-4764-a38b-3e378f24d609)

## Using roles in this way has several benefits

* **Role credentials are temporary and rotated automatically** = **Don't have to manage credentials** = **Don't have to worry about long-term security risks**.<br>
* **Single role for multiple instances** = **Make a change to that one role and the change is propagated automatically to all the instances**.<br>
* If your **current permissions grant you the ability to assume a specific IAM role**, then you can **identify that role in a "profile" in the AWS CLI configuration files** and that **command is then run with the permissions of the specified IAM role, not the original identity**.

## Named Profile in AWS CLI

* A **named profile is a collection of settings and credentials that you can apply to a AWS CLI command**.
* **When you specify a profile to run a command, the settings and credentials are used to run that command**.
* You **can specify one profile that is the "default"**, and is **used when no profile is explicitly referenced**.
* **Other profiles have names that you can specify as a parameter on the command line** for individual commands.
* AWS **CLI supports using any of multiple named profiles that are stored in the `config` and `credentials` files**.
* You can **configure additional profiles by using `aws configure` with the `--profile` option, or by adding entries to the `config` and `credentials` files**.