title: AWS IAM ROLE to access multiple services
body: <p>If EC2 instance required to have access to multiple AWS services(Like S3, SNS, SQS , CloudWatch etc), what is the best practice for granting access to EC2 instance,</p>
  
  <ul>
  <li>Should One ROLE has all the required permission</li>
  <li>OR </li>
  <li>Create multiple ROLE (You can only attach one ROLE to EC2 instance. Using config file you can use multiple role. Extra coding required depending upon which language you are using) - One for each service</li>
  </ul>
  
  <p>As per AWS documentation you should always create ROLE for EC2 and assign policy to ROLE according to your requirement.</p>
  
  <p>Is there any security concern with granting multiple service access to one ROLE? 
  Why I am asking is because Using EC2 metadata you can get the accesskey info assigned to the EC2 instance using that ROLE at that point. Keys are getting refreshed frequently by EC2.</p>
  
  <p>Any feedback or input.</p>