Fix IAM trust policy example to reference EC2 instance role

[Copilot]

The trust policy example for the target IAM role incorrectly referenced itself as the principal instead of the EC2 instance role that should be allowed to assume it.

Changes:

• Updated trust policy example to use distinct role names: pbm-ec2-instance-role for the EC2 instance role and pbm-target-role for the target role
• Fixed Principal.AWS field to reference the EC2 instance role ARN instead of the target role ARN
• Updated accompanying text and notes to reflect the correct role names

Before:

{
  "Principal": {
    "AWS": "arn:aws:iam::EC2_ACCOUNT_ID:role/pbm-target-role"
  },
  "Action": "sts:AssumeRole"
}

After:

{
  "Principal": {
    "AWS": "arn:aws:iam::EC2_ACCOUNT_ID:role/pbm-ec2-instance-role"
  },
  "Action": "sts:AssumeRole"
}

This corrects the IAM role assumption pattern: the trust policy attached to the target role must specify which role (the EC2 instance role) is permitted to assume it.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.