Profiles control which users have access to what systems. If key management is enabled, users can associate their SSH key to end systems through their assigned profile(s).
Both systems and users can be assigned to a profile. When a user is removed from a profile, they are no longer able to access systems under that profile through a web-terminal. Also, any of the associated user's SSH keys are automatically revoked when a user or system is removed from a profile.
Note: With Bastillion for EC2 systems (or instances) are not assigned directly to a profile. Profiles are defined with tags that are associated with instance tags in the AWS console.