Find IAM service on the search bar and click on it
Choose Roles on the sidebar, then click Create role
In the role creation interface, at Select trusted entity step:
Trusted entity type choose AWS Service
Use case choose EC2
Click Next
In the role creation interface, at Add permissions step:
Find, choose role AmazonSSMManagedInstanceCore (allow safe connection to instance without SSH key) and AmazonS3ReadOnlyAccess (allow instance to download code from S3)
Click Next
In the role creation interface, at Name, review, and create step: