# Set Up IAM Role Permissions for an AWS EC2 AIQ Controller

# Set Up IAM Role Permissions for an AWS EC2 AIQ Controller

Use an IAM role for an EC2-hosted AIQ Controller when the controller must access AWS services without long-lived access keys. Scope permissions to the exact services and resources required by the integration.

## Security checklist

- Prefer an EC2 instance profile over static IAM user keys.
- Create a least-privilege policy for the required AWS services, actions, and resources.
- Attach the role only to the AIQ Controller instances that need the access.
- Use tags, account boundaries, and environment separation to avoid cross-environment access.
- Review CloudTrail or equivalent logs after the first validation run.

## Validation workflow

1. Attach the IAM role or instance profile to the EC2 Controller.
2. Restart or refresh the integration if required by the workflow.
3. Run a small AIQ operation that uses the AWS permission.
4. Confirm access succeeds and no broader permissions are required.
5. Document role name, policy owner, AWS account, and review date.

*Last updated: October 8, 2026*