Description

Detects AWS EC2 instances running without an attached IAM instance profile, which means they lack proper identity and access management configuration. Running instances without IAM profiles can lead to insecure credential management and violates the principle of least privilege, as applications running on these instances may need to store AWS credentials locally or use less secure authentication methods.

Detection Strategy

• Scans all non-terminated EC2 instances in the specified AWS region

• Checks if each running or stopped instance has an IAM instance profile configuration

• Reports a vulnerability for any active instance that does not have an 'IamInstanceProfile' configuration set