Issue Using CodeDeploy with EC2 without public IPv4 address

Question

Hi there,

I'm attempting to use CodeDeploy to send my application code to an EC2 instance I have running in VPC I created. This VPC assigns IPv6 addresses and I am trying to avoid using public IPv4 addresses as much as possible. The VPC does have an internet gateway that the public subnets can access, and my EC2 instance is on one of these subnets.

I was able to successfully install the CodeDeploy agent onto the machine using the install script, although I had to add 'dualstack' to the s3 link to wget the install script, and I had to modify the s3 call within the script to use 'dualstack' as well when it downloaded the agent files.

I was also able to successfully install ruby and the dotnet runtime using apt-get.

However, when running the CodeDeploy process, the agent on the EC2 instance has the following in the log file,
```
2025-07-11T01:17:02 ERROR [codedeploy-agent(1932)]: InstanceAgent::Plugins::CodeDeployPlugin::CodeDeployControl: Error during certificate verification on codedeploy endpoint https://codedeploy-commands.us-west-1.amazonaws.com
2025-07-11T01:17:02 DEBUG [codedeploy-agent(1932)]: InstanceAgent::Plugins::CodeDeployPlugin::CodeDeployControl: #
2025-07-11T01:17:02 ERROR [codedeploy-agent(1932)]: Error validating the SSL configuration: Invalid server certificate
2025-07-11T01:17:02 ERROR [codedeploy-agent(1932)]: booting child: error during start or run: SystemExit - Stopping CodeDeploy agent due to SSL validation error. - /opt/codedeploy-agent/lib/instance_agent/plugins/codedeploy/command_poller.rb:65:in `abort'
```

According to the DEBUG line, it is unable to access codedeploy-commands.us-west-1.amazonaws.com via HTTPS. My security group for the VPC has outgoing connections for IPv4 and IPv6 wide open.

Why is the agent on my instance unable to access the codedeploy endpoint?

Thanks!

Matt M · Accepted Answer

I've answered my question. Yes, using a "dualstack" configuration means assigning a public IPv4 address in addition to the IPv6 address. This is ultimately the route I went down, and once CodeDeploy is made to work with IPv6 only, I will remove the IPv4 and things should continue to work.

The NAT Gateway w/ NAT64 and DNS64 functionality solution is relatively expensive compared to using public IPv4 addresses.

re:Post Agent · Answer

The issue you're experiencing is because the AWS CodeDeploy agent does not currently support IPv6 communication. Even though you've set up your VPC with IPv6 addresses and have an internet gateway configured, the CodeDeploy agent can only communicate over IPv4.

To resolve this issue, you need to configure your instances to use both IPv4 and IPv6 addresses (dual-stack mode). This will allow the CodeDeploy agent to communicate over IPv4 while the rest of your application can use IPv6 addresses.

The error message you're seeing indicates that the CodeDeploy agent is trying to connect to the CodeDeploy service endpoint (codedeploy-commands.us-west-1.amazonaws.com) but is unable to establish a connection because it's attempting to use IPv6 while the agent only supports IPv4.

For IPv6-only instances that need to communicate with IPv4-only destinations (like the CodeDeploy service), you would typically need to implement NAT64 and DNS64 functionality using an Amazon VPC NAT Gateway. This allows IPv6-only instances to communicate with IPv4-only destinations by translating IPv6 packets to IPv4 and synthesizing AAAA records for IPv4-only destinations.

However, in this specific case, the simplest solution is to assign a public IPv4 address to your EC2 instance or use a dual-stack configuration to allow the CodeDeploy agent to function properly.  
**Sources**  
[Migration issue from ipv4 to ipv6 | AWS re:Post](https://repost.aws/questions/QUztYsMQMZQyWcyqJpbzCeGA/migration-issue-from-ipv4-to-ipv6)  
[EC2 instances cannot reach IPv4 in dualstack VPC | AWS re:Post](https://repost.aws/questions/QUc3d0Eo1uQtW9UVvEiRCUOg/ec2-instances-cannot-reach-ipv4-in-dualstack-vpc)

Issue Using CodeDeploy with EC2 without public IPv4 address

Add your answer

Relevant content