2 questions on Workspaces (Core Managed instances). First - we deployed our VDAs with no instance profile (as they didnt need any special permisisons) and now we've been told all instances need an instance profile by our internal cloud team. We can create a new launch template to deploy new VMs that has an instance profile (that is empty of course) and it works great. When we try to apply an instance profile (the same one) to an existing VM, it fails and says due to a resource policy. Our internal cloud team isn't aware of any resource policy that would prevent it, and we confirmed we ca do it on a regular EC2 instance - is this an AWS managed field that is blocking us, and if so, how do we remediate? Second - and this may be more general AWSy thing - how would we boot to safe mode and still access the VM? I have not even been succesful in getting the VM to boot into safe mode - I set it, reboot, it comes back on normally. We have no EC2 serial console access by our account either. I set the RDP service to be included in the safemode with networking, but I just can't get it to actually boot in safe mode at all. Thoughts on how to do that?

You'll need EC2 serial console access for safe mode.

Look in cloud trail for the issue when using the instance profile aka Launch Template. Probably the launch template is linked to a subnet attached to a different AZ

Do you mean to see a success? It builds successfully when the instance profile is attached to a launch template. Its only when we try to add an instance profile manually after an instance is built that it fails

oh wait, you can't do that I think. The machine profile is used for the instance's creation. It has no use after.