tl;dr - WorkSpaces specific APIs replace standard EC2 APIs for mutable actions and maintain the protected boundaries. Let's start with the basics. Core Managed Instances (CMI) are EC2 instances with delegated control to the WorkSpaces Managed Instances service. All mutable actions must go through the WorkSpaces Managed Instances service, not standard EC2 APIs, likely in your case through the Citrix Cloud Connectors. See the attached image from the architecture docs. The resource policy error is from protected boundaries that CMI maintains by design. If the service role wasn't already created, here's the command to create it:

aws iam create-service-linked-role --aws-service-name <http://workspaces-instances.amazonaws.com|workspaces-instances.amazonaws.com>

I would redeploy with a new Machine Catalog that includes the instance profile from the start.