I believe it should be - though I've not done it myself. One example I found was https://dev.to/stack-labs/securing-access-to-aws-iam-roles-f....

In addition, you can just assign IAM roles to the runner EC2 instances themselves, placing ALL of the authentication and authorization in AWS rather than in GitLab. Then the runner will only be able to access the things that you allow through its IAM policy.