I am new to AWS Bash Scripting, and working currently on a task that needs to –

1. Go through all OUs
2. Go through all accounts in each of the OUs
3. Go through all EC2 instances in each of the accounts
4. Attach a specific permission policy to the instance profile of each of the EC2 instance (it’s guaranteed that there will be an instance profile already on the EC2 instance)

Note

1. It’s guaranteed that there will be an instance profile already on the EC2 instance
2. The EC2 instances may be present in multiple regions

I could find below commands that can help in this exercise –>

• For #1 –> list-organizational-units-for-parent
• For #2 –> list-accounts-for-parent
• For #3 –> describe-instances
• For #4 –> attach-role-policy

Questions

1. Am I on right track with the above commands?
2. describe-instances does not seem to have a parameter which can be used to indicate which account it should retrieve the instances from?
3. Should I use ‘aws ec2 describe-iam-instance-profile-associations’ to get instance profiles of all EC2 instances? But, all EC2 implies? Which account?

Any pointers will be much appreciated.

I have not started writing a full script, as I wanted to get direction on how I should proceed.