I have an IAM role for EC2 instance (so called Instance Profile) with two policies attached, giving full access to SQS and S3. There is an EC2 instance running associated with this role. It runs several apps, that do use temporary credentials and everything is working fine.
Right now, one of my apps needs also access to SNS. I've modified IAM role, adding an Inline policy with policy generator, allowing certain API calls for particular SNS topic. However after modification of IAM role, when trying aws sns list-topics
I get following error (respective arn's replaced with triple X):
User: XXX is not authorized to perform: SNS:ListTopics on resource: XXX:*
Does the addition of policy require instance to be restarted? Or do I have to wait for the temporary credentials (/latest/meta-data/iam/security-credentials/iam-role-name
) to expire? Can I somehow force expiration of those credentials?
EDIT: The last question seems to be answered by IAM FAQ. Temporary credentials can't be reactivated or extended.