In Array Server/Studio on Cloud configuration, the access/private key either needs to be able to create roles/policies/instance profiles, or the ARN of the instance profile needs to be created by the admin and specified in the ArrayServer.cfg. If ARN was manually created and specified, this ARN will need to be able to access the buckets specified in the ArrayServer.cfg, as well as being able to launch/terminate EC2 instances.

[Cloud]
Provider=Amazon
Region=us-east-1
AccessKey=xxxxxxxxxxxxxxxxxxx
SecretKey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
UseHttp=False
OmicsoftCloudDirectory=s3://east.dev.omicsoft/ArrayServerOmicsoftHome
MaxInstanceCount=5
UseReducedRedundancy=False
EnableDataEncryption=False
InstanceProfileArn=arn:aws:iam::xxxxxxxxxxxxx:instance-profile/project/xxx-xxx-omicsoft-xxxxxxxxxx

Also Read

• Demystifying EC2 Resource-Level Permissions
• AWS::IAM::InstanceProfile