AWS CloudFormation Starting EC2 Instance Requires ec2:RunInstances Permission

Another weird case with AWS CloudFormation. 

Problem

I attempted to start an EC2 instance and for somewhat reason it failed and said it doesn't have ec2:RunInstances permission, but it does. After few checks, I found out that the cause is the IamInstanceProfile. If it is set, the error happens. 

Solution

With clue from some online forum, I tried adding iam:PassRole permission for CloudFormation instead of the required ec2:RunInstances and it works!