IAM Role, Policy and Instance Profile for Keyless Entry

cfn.json

"InstanceRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [ {
            "Effect": "Allow",
            "Principal": {
              "Service": [ "ec2.amazonaws.com" ]
            },
            "Action": [ "sts:AssumeRole" ]
            } ]
        },
        "Path": "/"
      }
    },

    "InstancePolicies": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "root",
        "PolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeTags"
              ],
              "Resource":"*"
            }
          ]
        },
        "Roles": [ { "Ref": "InstanceRole" } ]
      }
    },

    "RootInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [ { "Ref": "InstanceRole" } ]
      }
    },

instance.json

"IamInstanceProfile": { "Ref": "RootInstanceProfile" },