Permissions required to launch an EC2 instance with IAM role?

For an IAM user to launch an Ec2 instance, “EC2 RunInstances” permission needs to be granted to respective IAM users. Also, if the user lacks PassRole permission he/she cannot associate any role with the instance during a launch.

PassRole permission is a security protection which means that the instance when launched the IAM role assigned to this IAM user will automatically pass on to the launched instance i.e. if the user is allowed S3 access role then only S3 role can be attached to the launched instance.