4

aws deploy register-on-premises-instance --instance-name XXXXX --iam-user-arn arn:aws:iam::XXXXXXXXXXXX:user/LightSailCodeDeployUser --region ap-south-1

An error occurred (AccessDeniedException) when calling the RegisterOnPremisesInstance operation: User: arn:aws:sts::XXXXXXXXXXX:assumed-role/AmazonLightsailInstanceRole/i-XXXXXXXXXXXXXX is not authorized to perform: codedeploy:RegisterOnPremisesInstance on resource: arn:aws:codedeploy:ap-south-1:XXXXXXXXXX:instance:XXXXXXXXXXXX

I didn't even create the role AmazonLightsailInstanceRole, then how did it come in the picture. My user have all permissions on codedeploy though. I am following this link to set up. https://aws.amazon.com/blogs/compute/using-aws-codedeploy-and-aws-codepipeline-to-deploy-applications-to-amazon-lightsail/

vijayK
  • 41
  • 6
  • Can you let me know what's the issue with the code. I have removed that " after --instance-name – vijayK May 14 '20 at 06:35

3 Answers3

3

I made the same mistake and then realized that command is meant to be run on your local machine and not the instance!

Josh
  • 2,122
  • 1
  • 21
  • 28
2

AmazonLightsailInstanceRole is a service-linked role automatically created by aws:

Service-linked roles are predefined by the service and include all the permissions that the service requires to call other AWS services on your behalf.

The error you are getting is not about you not having the codedeploy:RegisterOnPremisesInstance permission.

The error is about the AmazonLightsailInstanceRole not having it. It does not matter if you (i.e. your IAM user) has all CodeDeploy permissions.

Normally you would add the missing permissions to the role. How to work with the AmazonLightsailInstanceRole is described in the following AWS documentaiton:

However, I'm not sure if you can modify the AmazonLightsailInstanceRole and add the missing permissions. Some service-linked roles can be modified, some not.

Marcin
  • 215,873
  • 14
  • 235
  • 294
  • Did you find if you can edit `AmazonLightsailInstanceRole` or add a specific IAM policy to Lightsail instance ? – GuillaumeRZ Jul 26 '21 at 09:18
2

The documentation is a bit confusing. Create a new user in IAM with admin role (full privileges) and use the credentials of that user to run the command in your local machine.

Shania
  • 244
  • 2
  • 9