aws-cdk-lib/aws-ec2: cfnInstance does not attach instance profile

[ahfx]

Describe the bug

I am writing a CDK app in typescript. I am using the ec2.CfnInstance construct because it exposes more options than ec2.Instance

When passing a instance profile name to iamInstanceProfile of the construction props, the resulting instance does not have a role attached to it.

Expected Behavior

After launching my cdk stack I would expect and instance profile association with my instance id

Current Behavior

No association exists, eg:

aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=i-0bfe0741f9cbd1c78
{
    "IamInstanceProfileAssociations": []
}

Reproduction Steps

Launch a cdk typescript app with the following construct snippet

    const instanceRole = new iam.Role(this, 'InstanceRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      description: 'EC2 Instance Role',
    });

    const cfnInstanceProfile = new iam.CfnInstanceProfile(this, 'InstanceProfile', {
      roles: [instanceRole.roleName],
    });

    const linux_ami = ec2.MachineImage.latestAmazonLinux()

    const cfnInstance = new ec2.CfnInstance(this, 'Instance',  {
        imageId: linux_ami.getImage(this).imageId,
        instanceType: 't2.micro',
        tags: [{
            key: 'Name',
            value: 'Test Instance Profile',
          }],
        iamInstanceProfile: cfnInstanceProfile.instanceProfileName
    })

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.20.0 (build 738ef49)

Framework Version

No response

Node.js Version

v16.10.0

OS

MacOS

Language

Typescript

Language Version

TypeScript 4.6.3

Other information

No response

[peterwoodworth]

Hey @ahfx, I've managed to reproduce this.

Our CfnInstanceProfile class does have the instanceProfileName property, but it would only be set if you define that property since that's one of the input properties to the CfnInstanceProfile construct.

If you desire to return the name of the CfnInstanceProfile (which won't be set at synthesis) use cfnInstanceProfile.ref here instead. This fixed the issue for me

The way you're doing it now, the template isn't outputting anything at all for the IamInstanceProfile property, so that's why you're not running into any errors.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.