Error adding Windows worker to Deadline Cloud Customer Managed Fleet

Question

When trying to configure a customer managed fleet in deadline cloud to support windows workers, I found an error in the documentation about creating a policy to allow the fleet to access the secret containing the worker password.  The policy sample is missing from this page `https://docs.aws.amazon.com/deadline-cloud/latest/developerguide/manage-access-windows-secrets.html`.  I created a generic policy and continued, but the worker gets the following errors when trying to install the worker service.

```
[2025-09-29 11:08:01,067][INFO    ] 👋 Worker Agent starting
[2025-09-29 11:08:01,068][INFO    ] AgentInfo 
Python Interpreter: C:\Users\Administrator\AppData\Local\Programs\Python\Python313\pythonservice.exe
Python Version: 3.13.7 (tags/v3.13.7:bcee1c3, Aug 14 2025, 14:15:11) [MSC v.1944 64 bit (AMD64)]
Platform: win32
Agent Version: 0.28.14
Installed at: C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages
Running as user: deadline-worker
Dependency versions installed:
	openjd.model: 0.8.4
	openjd.sessions: 0.10.4
	deadline.job_attachments: 0.52.1
[2025-09-29 11:08:01,072][WARNING ] Could not detect GPU count, nvidia-smi not found
[2025-09-29 11:08:01,073][WARNING ] Could not detect GPU memory, nvidia-smi not found
[2025-09-29 11:08:01,075][INFO    ] Deadline Cloud telemetry is enabled.
[2025-09-29 11:08:08,163][INFO    ] Not running on EC2 or the metadata service was unable to be found!
[2025-09-29 11:08:08,163][INFO    ] IMDS is not reachable. Worker host is not an EC2 instance or IMDs is turned off.
[2025-09-29 11:08:10,368][INFO    ] 💻 Worker.Load 💻 Creating worker for hostname "WIN-F30B3B1OG4U" [farm-203cfd3c087a4e5ca877d6622737f6a0/fleet-9197ccc09d6243a4852ac16a8f03a69d]
[2025-09-29 11:08:10,369][INFO    ] 📤 API.Req 📤 [deadline:CreateWorker] resource={'farm-id': 'farm-203cfd3c087a4e5ca877d6622737f6a0', 'fleet-id': 'fleet-9197ccc09d6243a4852ac16a8f03a69d'} params={'hostProperties': {'ipAddresses': {'ipV4Addresses': ['127.0.0.1', '192.168.20.182'], 'ipV6Addresses': ['0000:0000:0000:0000:0000:0000:0000:0001', 'FE80:0000:0000:0000:1029:68F2:E00C:C64E']}, 'hostName': 'WIN-F30B3B1OG4U'}} request_url=https://scheduling.deadline.us-west-2.amazonaws.com/2023-10-12/farms/farm-203cfd3c087a4e5ca877d6622737f6a0/fleets/fleet-9197ccc09d6243a4852ac16a8f03a69d/workers
[2025-09-29 11:08:10,370][CRITICAL] Unexpected exception calling CreateWorker. Please report this to the service team.
Traceback (most recent call last):
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\deadline_worker_agent\aws\deadline\__init__.py", line 414, in create_worker
    response = deadline_client.create_worker(
        farmId=config.farm_id,
        fleetId=config.fleet_id,
        hostProperties=host_properties,
    )
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\deadline_worker_agent\boto\shim.py", line 71, in create_worker
    return create_worker_method(**create_worker_kwargs)  # type: ignore
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\client.py", line 602, in _api_call
    return self._make_api_call(operation_name, kwargs)
           ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\context.py", line 123, in wrapper
    return func(*args, **kwargs)
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\client.py", line 1060, in _make_api_call
    http, parsed_response = self._make_request(
                            ~~~~~~~~~~~~~~~~~~^
        operation_model, request_dict, request_context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\client.py", line 1084, in _make_request
    return self._endpoint.make_request(operation_model, request_dict)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\endpoint.py", line 119, in make_request
    return self._send_request(request_dict, operation_model)
           ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\endpoint.py", line 196, in _send_request
    request = self.create_request(request_dict, operation_model)
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\endpoint.py", line 132, in create_request
    self._event_emitter.emit(
    ~~~~~~~~~~~~~~~~~~~~~~~~^
        event_name,
        ^^^^^^^^^^^
        request=request,
        ^^^^^^^^^^^^^^^^
        operation_name=operation_model.name,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\hooks.py", line 412, in emit
    return self._emitter.emit(aliased_event_name, **kwargs)
           ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\hooks.py", line 256, in emit
    return self._emit(event_name, kwargs)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\hooks.py", line 239, in _emit
    response = handler(**kwargs)
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\signers.py", line 108, in handler
    return self.sign(operation_name, request)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\signers.py", line 200, in sign
    auth.add_auth(request)
    ~~~~~~~~~~~~~^^^^^^^^^
  File "C:\Users\Administrator\AppData\Local\Programs\Python\Python313\Lib\site-packages\botocore\auth.py", line 422, in add_auth
    raise NoCredentialsError()
botocore.exceptions.NoCredentialsError: Unable to locate credentials
[2025-09-29 11:08:10,377][ERROR   ] CreateWorker received an unrecoverable error: Unable to locate credentials
[2025-09-29 11:08:10,377][INFO    ] 🚪 Worker Agent exiting
```
And the worker does not register to the fleet.

re:Post Agent · Answer

The error you're encountering with your Windows worker in Deadline Cloud Customer Managed Fleet is related to missing credentials. The "Unable to locate credentials" error indicates that the worker cannot authenticate with AWS services.

This issue is likely related to the fleet role configuration. When creating a customer-managed fleet (CMF), you need to properly set up an IAM role for the workers in your fleet. This role provides the necessary security credentials for workers to run jobs and interact with AWS services.

For a customer-managed fleet, you need to:

1. Create an IAM role with a trust policy that allows the Deadline Cloud service to assume the role:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "credentials.deadline.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
```

2. Attach a policy to this role that grants the necessary permissions for workers, including:
- deadline:AssumeFleetRoleForWorker
- deadline:UpdateWorker
- deadline:DeleteWorker
- deadline:UpdateWorkerSchedule
- deadline:BatchGetJobEntity
- deadline:AssumeQueueRoleForWorker
- Permissions for CloudWatch Logs

3. When configuring your queue with a Windows `jobRunAsUser`, you need to create an AWS Secrets Manager secret containing the password in JSON format:
```
{
"password": "JOB_USER_PASSWORD"
}
```

4. Ensure the fleet's IAM role has permissions to access this secret. If the secret is encrypted with a customer-managed KMS key, the role also needs permissions to decrypt using that key.

To fix your issue:
1. Verify that the fleet role is correctly configured with the necessary permissions
2. Check that the worker has access to the fleet role credentials
3. If using a Windows `jobRunAsUser`, ensure the fleet role has permissions to access the password secret in AWS Secrets Manager

You might also want to check CloudTrail logs for any access denied errors, which can help pinpoint permission issues with your fleet role.  
**Sources**  
[Troubleshooting - AWS Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/troubleshooting.html)  
[Manage access to Windows job user secrets - Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/developerguide/manage-access-windows-secrets.html)  
[Create a customer-managed fleet - Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/developerguide/create-a-cmf.html)  
[Create a Deadline Cloud farm - Deadline Cloud](https://docs.aws.amazon.com/deadline-cloud/latest/developerguide/create-a-farm.html)

Error adding Windows worker to Deadline Cloud Customer Managed Fleet

Add your answer

Relevant content