You must grant an IAM user two distinct permissions to successfully launch EC2 instances with roles: