ec2 policy for codedeploy

Question

# IAM Role for EC2 instances 
        
        ec2_role = iam.Role(
            self,
            "ec2Role",
            assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"),
            managed_policies=[
                iam.ManagedPolicy.from_aws_managed_policy_name(
                    "AmazonSSMManagedInstanceCore"
                ),
                iam.ManagedPolicy.from_aws_managed_policy_name(
                    "AmazonEC2ReadOnlyAccess"
                ),
                iam.ManagedPolicy.from_aws_managed_policy_name(
                    "AWSCodeDeployRole"
                ),

instances failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Policy arn:aws:iam::aws:policy/AWSCodeDeployRole does not exist or is not attachable. (Service: Iam, Status Code: 404, Request ID: 42ad01f3-5bed-474d-82f1-f3274ea28bf0) (SDK Attempt Count: 1)" (RequestToken: 96f3cc20-cb5e-d373-750b-0d99e687cb9e, HandlerErrorCode: NotFound)

please provide correct policy to add here to access codedeploy for ec2 by cdk

Riku_Kobayashi · Answer

Hello.

As described in the following document, depending on the IAM policy you use, you may need to include "service-role/" or "job-function/" in the name.  
https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_iam/ManagedPolicy.html  
> Import a managed policy from one of the policies that AWS manages.  
> For this managed policy, you only need to know the name to be able to use it.  
> Some managed policy names start with “service-role/”, some start with “job-function/”, and some don’t start with anything. Include the prefix when constructing this object.

In this case, the IAM policy ARN contains "service-role/", so please set it with "service-role/" in the name.  
https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCodeDeployRole.html  
> ARN: arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole

Please try it as follows:  
```
            iam.ManagedPolicy.from_aws_managed_policy_name(
                "service-role/AWSCodeDeployRole"
            ),
```

ec2 policy for codedeploy

IAM Role for EC2 instances

Add your answer

Relevant content