A developer is using AWS CodeDeploy to launch an application onto Amazon EC2 instances. The application deployment fails during testing. The developer notices an IAM_ROLE_PERMISSIONS error code in Amazon CloudWatch logs. What should the developer do to resolve the error?

The IAMROLEPERMISSIONS error code specifically indicates that the AWS CodeDeploy service role lacks the necessary IAM permissions to interact with other AWS services on your behalf. For deployments targeting Amazon EC2 instances, CodeDeploy needs to perform actions such as describing EC2 instances, Auto Scaling groups, and tags to identify the deployment targets. The AWS-managed policy AWSCodeDeployRole is designed to grant exactly these permissions. Attaching this policy to the CodeDeploy service role resolves the issue by providing the service with the authority it needs to execute the deployment successfully.

A. An incorrect role name would typically cause an "Invalid IAM Role" error, not a permissions-specific error like IAMROLEPERMISSIONS.
B. The AWSCodeDeployRoleECS policy grants permissions for deployments to Amazon Elastic Container Service (ECS), not the Amazon EC2 instances specified in the question.
D. A missing or non-running CodeDeploy agent on the EC2 instances would lead to different errors, such as deployment lifecycle event failures or timeouts, not an IAMROLEPERMISSIONS error.

1. AWS CodeDeploy User Guide, "Error codes for CodeDeploy": The documentation for the IAMROLEPERMISSIONS error states, "The service role you are using does not have sufficient permissions to make a request." This directly points to a permissions issue with the service role.

2. AWS CodeDeploy User Guide, "Step 2: Create a service role for CodeDeploy": This section explicitly recommends attaching the AWSCodeDeployRole managed policy to the service role. It states, "CodeDeploy needs permissions to expand tags and to read the Amazon EC2 Auto Scaling group names associated with your AWS account. To provide these permissions, attach the AWSCodeDeployRole managed policy..."

3. AWS Identity and Access Management User Guide, "AWS managed policies for CodeDeploy": This document describes the AWSCodeDeployRole policy as granting "CodeDeploy permissions to access your Amazon EC2 instances, Amazon EC2 Auto Scaling groups, Elastic Load Balancers, and Amazon S3 buckets on your behalf," confirming it is the correct policy for EC2/On-Premises deployments.