A single AWS account in one Region runs hundreds of EC2 instances that are frequently launched and terminated. Security policy requires every running EC2 instance to have an instance profile; if none is attached, a default profile with no IAM permissions must be applied. The engineer found existing instances without an instance profile and ongoing launches that also omit a profile. What will ensure all current and future EC2 instances in the Region have an instance profile attached?

The ec2-instance-profile-attached AWS Config managed rule directly addresses the requirement by checking if EC2 instances have an instance profile. By enabling automatic remediation, AWS Config can automatically trigger a Systems Manager Automation runbook to attach the default instance profile to non-compliant instances, both existing and newly launched. This ensures continuous compliance. The EventBridge rule reacting to RunInstances API calls could work for new instances but wouldn't address existing non-compliant instances. Reacting to StartInstances is insufficient as instances can be launched without being started. The iam-role-managed-policy-check rule checks IAM roles for managed policies, not whether EC2 instances have an instance profile attached, making it irrelevant to this problem.