Two IAM Role for ec2 instance with Kerberos authentication

To associate IAM roles with your AD groups when authenticating to your EC2 instance via Kerberos, you'll need to implement a solution that maps your AD groups to the appropriate IAM roles.

AWS Directory Service provides the ability to give your AWS Managed Microsoft AD users and groups access to AWS resources by assigning IAM roles and policies to those users and groups. This allows different levels of access based on group membership.

For your specific scenario with Cloud-Admins and Cloud-Developers roles, you would need to:

1. Ensure your IAM roles (Cloud-Admins and Cloud-Developers) have the appropriate permissions defined for the different privilege levels you want.

2. Edit the trust relationship for these roles to allow them to be assumed by your directory service.

3. Assign your AD groups (Admins and Developers) to the corresponding IAM roles (Cloud-Admins and Cloud-Developers).

When users authenticate to the EC2 instance via Kerberos, the system can then determine their group membership and apply the appropriate IAM role permissions based on whether they belong to the Admins or Developers group.

For EC2 instances specifically, you would need to attach the appropriate IAM role to the instance using the AWS CLI, PowerShell, or the EC2 console. For example, using PowerShell, you could use the Register-EC2IamInstanceProfile cmdlet to attach a role to an instance.

Remember that to perform these operations, you need the necessary permissions, including ec2:AssociateIamInstanceProfile and iam:PassRole.
Sources
Grant permissions to attach an IAM role to an instance - Amazon Elastic Compute Cloud
Attach an IAM role to an instance - Amazon Elastic Compute Cloud
Granting AWS Managed Microsoft AD users and groups access to AWS resources with IAM roles - AWS Directory Service