AWS Code Deploy - deployment failed

Question

I am trying to setup code deployment using aws, but when I try to perform deployment, I am getting this error:

2016-06-08 23:57:11 ERROR [codedeploy-agent(1207)]: InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: Cannot reach InstanceService: Aws::CodeDeployCommand::Errors::AccessDeniedException -
2016-06-08 23:58:41 INFO  [codedeploy-agent(1207)]: Version file found in /opt/codedeploy-agent/.version.
2016-06-08 23:58:41 INFO  [codedeploy-agent(1207)]: [Aws::CodeDeployCommand::Client 400 0.055741 0 retries] poll_host_command(host_identifier:"IAM-user-ARN") Aws::CodeDeployCommand::Errors::AccessDeniedException

I have two IAM roles - one for EC2 instance, and one for deployment app. S3 bucket have permission set for iam role which is used for deployment:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "XXXXXXXX:role/TestRole"
            },
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": "arn:aws:s3:::pmcdeploy/*"
        }
    ]
}

What is going on?

Amartya Datta Gupta · Accepted Answer · 2016-06-17 15:33:37Z

1

Is the error consistent? On looking at the agent code, it seems like the agent might having trouble talking to EC2. If this is a persistent problem, you can share the EC2 instance profile.

Also starting the agent with verbose option enabled gives a lot more information about what's going on.

Thanks

answered Jun 17, 2016 at 15:33

Amartya Datta Gupta

775 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

binbinlu · Accepted Answer · 2017-09-19 00:02:20Z

1

This is actually something related to the order of credential loading. The host agent is running with root user by default and also uses instance profile.

The exception is got when you've setup a root credential which has priority over instance profile according to: http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#config-settings-and-precedence

Then the aws sdk used by host agent will use the credential configured for the root user instead of instance profile to configure the requests.

One of the workaround would be run the agent with a different user and don't configure any credential for that user.

answered Sep 19, 2017 at 0:02

binbinlu

4262 silver badges5 bronze badges

Comments

Sudhir Dwivedi · Accepted Answer · 2021-05-13 19:12:09Z

1

I deleted /home/ubuntu/.aws and rebooted codedeploy agent service and it worked for me :-)

answered May 13, 2021 at 19:12

Sudhir Dwivedi

413 bronze badges

Comments

Florian Heigl · Accepted Answer · 2016-11-17 13:13:30Z

0

We had what I think the same issue. Our systems had a /root/.aws/credentials in place which CodeDeploy absolutely uses and I found no way of telling it to not do that. Especially no documentation...

In the end, we rewrote everything on our end to ensure we'll no longer need a credentials file in place. From that moment on, CodeDeploy used the instance profile and it was working fine.

answered Nov 17, 2016 at 13:13

Florian Heigl

1421 silver badge9 bronze badges

Collectives™ on Stack Overflow

AWS Code Deploy - deployment failed

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related