title: Can I attach a new IAM role to a running instance or not?
body: <p>In some case, people might have started an EC2 instance without giving a proper role and want to give it a role so that the instance would have some new privilege.</p>
  
  <p>From the AWS doc <a href="https://aws.amazon.com/blogs/security/new-attach-an-aws-iam-role-to-an-existing-amazon-ec2-instance-by-using-the-aws-cli/?sc_channel=sm&amp;sc_campaign=rolesforrunninginstances&amp;sc_publisher=tw&amp;sc_medium=social&amp;sc_content=read-post&amp;sc_country=global&amp;sc_geo=global&amp;sc_category=ec2&amp;sc_outcome=launch" rel="nofollow noreferrer">here</a>, it describes the way to attach a new IAM role to a what it calls "<strong>existing</strong>" instance, I wonder if the "<strong>existing</strong>" instance actually means a "<strong>running</strong>" instance? or there is a difference in AWS on "<strong>existing</strong>" and "<strong>running</strong>"?</p>
  
  <p>or shall I <strong>stop</strong> the instance in order to add a new role and <strong>restart</strong> it after the new role is attached?</p>
  
  <p>Thanks.</p>