This is a special kind of service role. When the EC2 instance is launched, we can attach a role to the instance. This role needs to give permission to access the resources needed by the application, which will run in the EC2 instance. The EC2 is given temporary credentials. These are then provided to the application that is running in the EC2 instance. 

The role can be attached to the EC2 instance before it starts, or it can be attached to a running instance.