More detail
When you launch an EC2 instance with an instance profile, or give Lambda an execution role, you are “passing” a role. You need iam:PassRole on that role. This stops someone with few permissions from launching a service with a powerful role and borrowing its power.