Step 2: Create a service role for CodeDeploy - Amazon CodeDeploy
Create a service role (console) Create a service role (CLI) Get the service role ARN (console) Get the service role ARN (CLI)
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Step 2: Create a service role for CodeDeploy

In Amazon, service roles are used to grant permissions to an Amazon service so it can access Amazon resources. The policies that you attach to the service role determine which resources the service can access and what it can do with those resources.

The service role you create for CodeDeploy must be granted the permissions required for your compute platform. If you deploy to more than one compute platform, create one service role for each. To add permissions, attach one or more of the following Amazon supplied policies:

For EC2/On-Premises deployments, attach the AWSCodeDeployRole policy. It provides the permissions for your service role to:

  • Read the tags on your instances or identify your Amazon EC2 instances by Amazon EC2 Auto Scaling group names.

  • Read, create, update, and delete Amazon EC2 Auto Scaling groups, lifecycle hooks, and scaling policies.

  • Publish information to Amazon SNS topics.

  • Retrieve information about CloudWatch alarms.

  • Read and update Elastic Load Balancing.

    Note

    If you create your Auto Scaling group with a launch template, you must add the following permissions:

    • ec2:RunInstances

    • ec2:CreateTags

    • iam:PassRole

    For more information, see Step 2: Create a service role, Creating a launch template for an Auto Scaling group, and Launch template support in the Amazon EC2 Auto Scaling User Guide.

For Amazon ECS deployments, if you want full access to support services, attach the AWSCodeDeployRoleForECS policy. It provides the permissions for your service role to:

  • Read, update, and delete Amazon ECS task sets.

  • Update Elastic Load Balancing target groups, listeners, and rules.

  • Invoke Amazon Lambda functions.

  • Access revision files in Amazon S3 buckets.

  • Retrieve information about CloudWatch alarms.

  • Publish information to Amazon SNS topics.

For Amazon ECS deployments, if you want limited access to support services, attach the AWSCodeDeployRoleForECSLimited policy. It provides the permissions for your service role to:

  • Read, update, and delete Amazon ECS task sets.

  • Retrieve information about CloudWatch alarms.

  • Publish information to Amazon SNS topics.

For Amazon Lambda deployments, if you want to allow publishing to Amazon SNS, attach the AWSCodeDeployRoleForLambda policy. It provides the permissions for your service role to:

  • Read, update, and invoke Amazon Lambda functions and aliases.

  • Access revision files in Amazon S3 buckets.

  • Retrieve information about CloudWatch alarms.

  • Publish information to Amazon SNS topics.

For Amazon Lambda deployments, if you want to limit access to Amazon SNS, attach the AWSCodeDeployRoleForLambdaLimited policy. It provides the permissions for your service role to:

  • Read, update, and invoke Amazon Lambda functions and aliases.

  • Access revision files in Amazon S3 buckets.

  • Retrieve information about CloudWatch alarms.

As part of setting up the service role, you also update its trust relationship to specify the endpoints to which you want to grant it access.

You can create a service role with the IAM console, the Amazon CLI, or the IAM APIs.

Create a service role (console)

  1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

  2. In the navigation pane, choose Roles, and then choose Create role.

  3. On the Create role page, choose Amazon service, and from the Choose the service that will use this role list, choose CodeDeploy.

  4. From Select your use case, choose your use case:

    • For EC2/On-Premises deployments, choose CodeDeploy.

    • For Amazon ECS deployments, choose CodeDeploy - ECS.

    • For Amazon Lambda deployments, choose CodeDeploy for Lambda.

  5. Choose Next: Permissions.

  6. On the Attached permissions policy page, the permission policy is displayed. Choose Next: Tags.

  7. On the Review page, in Role name, enter a name for the service role (for example, CodeDeployServiceRole), and then choose Create role.

    You can also enter a description for this service role in Role description.

  8. If you want this service role to have permission to access all currently supported endpoints, you are finished with this procedure.

    To restrict this service role from access to some endpoints, in the list of roles, browse to and choose the role you created, and continue to the next step.

  9. On the Trust relationships tab, choose Edit trust relationship.

  10. You should see the following policy, which provides the service role permission to access all supported endpoints:

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "codedeploy.amazonaws.com.cn"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

For more information about creating service roles, see Creating a role to delegate permissions to an Amazon service in the IAM User Guide.

Create a service role (CLI)

  1. On your development machine, create a text file named, for example, CodeDeployDemo-Trust.json. This file is used to allow CodeDeploy to work on your behalf.

    Save the following content in the file:

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "codedeploy.amazonaws.com.cn"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

  2. From the same directory, call the create-role command to create a service role named CodeDeployServiceRole based on the information in the text file you just created:

    aws iam create-role --role-name CodeDeployServiceRole --assume-role-policy-document file://CodeDeployDemo-Trust.json
    Important

    Be sure to include file:// before the file name. It is required in this command.

    In the command's output, make a note of the value of the Arn entry under the Role object. You need it later when you create deployment groups. If you forget the value, follow the instructions in Get the service role ARN (CLI) .

  3. Call the attach-role-policy command to give the service role named CodeDeployServiceRole the permissions based on the IAM managed policy named AWSCodeDeployRole. For example:

    aws iam attach-role-policy --role-name CodeDeployServiceRole --policy-arn arn:aws-cn:-cn:iam::aws:policy/service-role/AWSCodeDeployRole

For more information about creating service roles, see Creating a role for an Amazon service in the IAM User Guide.

Get the service role ARN (console)

To use the IAM console to get the ARN of the service role:

  1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

  2. In the navigation pane, choose Roles.

  3. In the Filter box, type CodeDeployServiceRole, and then press Enter.

  4. Choose CodeDeployServiceRole.

  5. Make a note of the value of the Role ARN field.

Get the service role ARN (CLI)

To use the Amazon CLI to get the ARN of the service role, call the get-role command against the service role named CodeDeployServiceRole:

aws iam get-role --role-name CodeDeployServiceRole --query "Role.Arn" --output text

The value returned is the ARN of the service role.