[Issue report]Misuse of iaminstanceprofile in aws_ec2_iaminstance.json due to missing EC2InstanceProfile object

[xiaoen-liu]

Title: Misuse of iaminstanceprofile in aws_ec2_iaminstance.json due to missing EC2InstanceProfile object

Description:

In aws_ec2_iaminstance.json (found here), Cartography incorrectly assumes a direct connection between the iaminstanceprofile name and the IAM Role. This assumption is not accurate, as AWS uses IamInstanceProfile as a distinct resource that links to a single IAM Role.

The misuse happens because Cartography does not currently create a separate EC2InstanceProfile object, leading to incorrect modeling of the relationship between EC2 Instances and IAM Roles.

Expected behavior:

A separate EC2InstanceProfile object should be created and properly linked to EC2 Instances.
The relationship between the EC2InstanceProfile and its associated IAM Role should be accurately represented, avoiding the incorrect assumption about the name correlation.

[optional Relevant Links:]

here

[achantavy]

@xiaoen-liu - Thanks for reporting, this is a valid issue.

To make sure I understand, the current model is

EC2 Instance ←→ IAM Role

but it should be this instead:

EC2 Instance ←→ IamInstanceProfile ←→ IAM Role

Is this right?

[xiaoen-liu]

Yes, without having the IamInstanceProfile as a separate model, it's not possible to correctly establish the node relationships between EC2 Instances and IAM Roles.

[xiaoen-liu]

I would like to further clarify the cause of this confusion. The creation of an AWS Instance Profile and the binding of an Instance Profile to an IAM Role are two separate API calls: IAM.Client.create_instance_profile and IAM.Client.add_role_to_instance_profile. These APIs do not require the instance profile name and the IAM role name to have any relationship.

However, the AWS Console design makes it appear as though the instance profile name and the IAM role name are identical, which leads to confusion. This issue becomes more pronounced when using Infrastructure as Code (IaC) tools like Terraform, CloudFormation, or CDK, where instance profile names and IAM role names are often completely different.

This discrepancy can cause significant issues in environments where IaC is used to manage AWS resources, making it important to properly model the distinction between instance profiles and IAM roles.

[chandanchowdhury]

From what I understand and also from looking at our tfstate files

aws_iam_instance_profile -(one-to-one)→ role

while

role -(one-to-many)→ aws_iam_instance_profile 

So not sure what the issue issue!

@xiaoen-liu Are you able to provide an example please?