Change overly permissive IAM Profile from using wildcard in list of actions required. Explictly define the 4 required ec2:Associate* Realized while investigating issue #14383, though change does not resolve that issue