Create a role for Amazon EC2 - Amazon GameLift Servers
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Create a role for Amazon EC2

This role enables your Amazon EC2 resources to communicate with Amazon GameLift Servers FleetIQ. For example, your game servers, which are running on Amazon EC2 instances, need to be able to report health status. Include this role in an IAM instance profile with your Amazon EC2 launch template when creating a Amazon GameLift Servers FleetIQ game server group.

Use the Amazon CLI to create a role for Amazon EC2, attach a custom policy with the necessary permissions, and attach the role to an instance profile. For more information, see Creating a Role for an Amazon Service.

Amazon CLI

These steps describe how to create a service role with custom Amazon GameLift Servers permissions for Amazon EC2 using the Amazon CLI.

  1. Create a trust policy file (example: FleetIQtrustpolicyEC2.json) with the following JSON syntax.

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

  2. Create a new IAM role with iam create-role and associate it with the trust policy JSON file that you just created.

    Windows: 

    Amazon iam create-role --role-name FleetIQ-role-for-EC2 --assume-role-policy-document file://C:\policies\FleetIQtrustpolicyEC2.json

    Linux: 

    Amazon iam create-role --role-name FleetIQ-role-for-EC2 --assume-role-policy-document file://policies/FleetIQtrustpolicyEC2.json

    When the request is successful, the response includes the properties of the newly created role. Take note of the ARN value. You will need this information when setting up your Amazon EC2 launch template.

  3. Create a permissions policy file (example: FleetIQpermissionsEC2.json) with the following JSON syntax.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "gamelift:*",
            "Resource": "*"
        }
    ]
}

  4. Use iam put-role-policy to attach the permissions policy JSON file, which you just created, to the new role.

    Windows: 

    Amazon iam put-role-policy --role-name FleetIQ-role-for-EC2 --policy-name FleetIQ-permissions-for-EC2 --policy-document file://C:\policies\FleetIQpermissionsEC2.json

    Linux: 

    Amazon iam put-role-policy --role-name FleetIQ-role-for-EC2 --policy-name FleetIQ-permissions-for-EC2 --policy-document file://policies/FleetIQpermissionsEC2.json

    To verify that the permissions policy is attached, call iam list-role-policies with the new role's name.

  5. Create an instance profile with iam create-instance-profile with the new role for use with Amazon EC2. For more information, see Managing Instance Profiles.

    Amazon iam create-instance-profile --instance-profile-name FleetIQ-role-for-EC2

    When the request is successful, the response includes the properties of the newly created instance profile.

  6. Use iam add-role-to-instance-profile to attach the role to the instance profile.

     Amazon iam add-role-to-instance-profile --role-name FleetIQ-role-for-EC2 --instance-profile-name FleetIQ-role-for-EC2

The role and profile is now ready to be used with an Amazon EC2 launch template.