# Authenticate with IAM Auto Discovery

> Where Cloud Management Platform (CMP) runs on an EC2 instance, an AWS handler can use the IAM role attached to that instance and hold no credentials at all

---

Site [llms.txt](/llms.txt)

---

CMP reads temporary credentials for the role from the EC2 instance metadata service, so nothing is stored in CMP, and nothing needs to be rotated. This suits AWS security guidance that favors roles over long-lived keys.

## Prerequisites

- CMP installed on an AWS EC2 instance. This option works only there, because the credentials come from that instance's metadata.
- An IAM role attached to that same EC2 instance, carrying the permissions listed under [AWS permissions](/docs/cmp/configure/infrastructure/resource-handlers/aws/#aws-permissions).

## Create the IAM role in AWS

1. In the IAM console, select **Roles**, then **Create role**.
1. Select **AWS service** as the trusted entity type and **EC2** as the use case, then select **Next**.
1. Attach a policy granting the permissions under [AWS permissions](/docs/cmp/configure/infrastructure/resource-handlers/aws/#aws-permissions), or select **Create policy** and paste them in as JSON.
1. Name the role and create it. You need its exact name in CMP.

## Attach the role to the EC2 instance running CMP

1. In the AWS console, go to **EC2** > **Instances** and open the instance CMP is installed on.
1. Go to **Actions** > **Security** > **Modify IAM role**.
1. Select the role you created and save.

The role must be on the instance CMP itself runs on, not on the instances CMP provisions.

## Create the handler

1. Go to **Admin** > **Resource Handlers** and select **Add**.
1. Select the **Amazon Web Services** tile.
1. Set **Credentials Type** to **IAM Auto Discovery**.
1. Enter the **EC2 Instance IAM Role Name**, exactly as it appears on the instance's Security tab in AWS.
1. Select **Continue**, then complete the handler's settings and select at least one region, as described under [Add an AWS resource handler](/docs/cmp/configure/infrastructure/resource-handlers/aws/#add-an-aws-resource-handler).

![Screenshot of the Create a Resource Handler for Amazon Web Services dialog with IAM Auto Discovery selected.](/img/cmp/configure/infrastructure/resource-handlers/aws/iam-auto-discovery/create-aws-resource-handler-iam-auto-discovery.png)

The role name appears on the handler's Overview tab. Use **Verify Connection** to confirm CMP can read the credentials.

## Related

- [AWS](/docs/cmp/configure/infrastructure/resource-handlers/aws/): the other credentials types, and what an AWS handler needs permission to do.
- [Authenticate with an IAM role](/docs/cmp/configure/infrastructure/resource-handlers/aws/iam-role/): assume a role from a stored account profile, for a CMP that does not run on EC2.