CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2aws-code-deploy
smart
smart

Reputation: 2065

AWS CodeDeploy: Service role Cannot assume role provided

I'm trying to setup CodeDeploy with my GitHub and I've found some issue.

I've created service role as mentioned in documentation with AWSCodeDeployRole policy.

During my Code Deploy Application creation process I've got an issue:

Cannot assume role provided.

As I can see, my role with AWSCodeDeployRole have a lot of autoscaling permissions, but it's not expected for me:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "autoscaling:CompleteLifecycleAction",
        "autoscaling:DeleteLifecycleHook",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribeLifecycleHooks",
        "autoscaling:PutLifecycleHook",
        "autoscaling:RecordLifecycleActionHeartbeat",
        "autoscaling:CreateAutoScalingGroup",
        "autoscaling:UpdateAutoScalingGroup",
        "autoscaling:EnableMetricsCollection",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribePolicies",
        "autoscaling:DescribeScheduledActions",
        "autoscaling:DescribeNotificationConfigurations",
        "autoscaling:DescribeLifecycleHooks",
        "autoscaling:SuspendProcesses",
        "autoscaling:ResumeProcesses",
        "autoscaling:AttachLoadBalancers",
        "autoscaling:PutScalingPolicy",
        "autoscaling:PutScheduledUpdateGroupAction",
        "autoscaling:PutNotificationConfiguration",
        "autoscaling:PutLifecycleHook",
        "autoscaling:DescribeScalingActivities",
        "autoscaling:DeleteAutoScalingGroup",
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceStatus",
        "ec2:TerminateInstances",
        "tag:GetTags",
        "tag:GetResources",
        "sns:Publish",
        "cloudwatch:DescribeAlarms",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeInstanceHealth",
        "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
        "elasticloadbalancing:DeregisterInstancesFromLoadBalancer"
      ],
      "Resource": "*"
    }
  ]
}

During some googling, I've found that CodeDeploy application may expect something similar to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "codedeploy.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

But when I'm trying to create this policy manually it also fails with error:

This policy contains the following error: Has prohibited field Principal For more information about the IAM policy grammar, see AWS IAM Policies.

So, what is the expected service role for Code Deploy Application?

Btw, Code deploy is running on my EC2 instance.

Upvotes: 7

Views: 5809

Answers (3)

Morgan
Morgan

Reputation: 55

I was following the tutorial but it didn't mention you have to edit the Trust Relationship for the service role. I got the same error as mentioned until I changed the below.

I changed

        "Service": "codebuild.amazonaws.com"

To

"Service" : [
      "codedeploy.amazonaws.com",
      "codebuild.amazonaws.com"
    ]

Upvotes: 0

B Fish
B Fish

Reputation: 363

For those that find this via Google - in my Cloud Formation templates, I formatted the ARN wrong, and the error wasn't descriptive:

Roles need to be specified this way: arn:aws:iam::1234567890:role/CodeDeployRole NOTE :role/ and not :instance-profile/

The error is exactly as above that it can't assume the role, though it's because you specified it wrong.

Upvotes: 2

smart
smart

Reputation: 2065

Well, according to @Michael comment, I've found some differences in my Trust relationships policy for Service role.

It looks like default AWSCodeDeployRole can't handle it properly for Code Deploy.

To fix this issue I've replaced "Service": [ "ec2.amazonaws.com"] with "Service": [ "codedeploy.amazonaws.com"]

And it works!

Upvotes: 16

Related Questions