AWS Elastic Beanstalk Sample App not able to use Role to obtain required permissions for Managed Updates

Question

I am going through their sample app tutorial here: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/GettingStarted.html and even though I am able to get a working app from Step 1, I consistently get warning messages about being unable to assume the Service Role I set up for this app and being unable to find permissions to check for managed updates. I already set up a service role with all the permissions listed here: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-servicerole.html, and my understanding is that I should be able to get managed updates with this app.

I have attached the error I am seeing on my environment page.

Also attaching the screenshot of what I see on my role I named newpolicy@.

I even tried attaching the necessary policies directly to my user, which is the root user of the account.

I have deleted the app, environment, and role, and rebuilt them using the Amazon tutorials from scratch, multiple times, all with the same problem.

Tried creating a new app, with a new environment, and created a new role with added permissions including AWSElasticBeanstalkEnhancedHealth and AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy along with the standard AWSElasticBeanstalkWebTier, AWSElasticBeanstalkWorkerTier, AWSElasticBeanstalkMulticontainerDocker recommended by the tutorial.

I expected to see a new app with no issues, but instead, I am getting warning events:

Unable to assume role "arn:aws:iam::xxxxxx:role/newpolicy@". Verify that the role exists and is configured correctly.

Service role "arn:aws:iam::xxxxxx:role/newpolicy@" is missing permissions required to check for managed updates. Verify the role's policies.

I can still view the sample app when I click the provided url, however.

In response to Arpit Jain's question: here are my trust relationships for newpolicy@:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

In response to Arpit Jain's answer below, here is the profile info for my new environment:

Audiogenic

Have you added the trust policy for the role - newpolicy@ to allow the Elastic Beanstalk to assume the role? – Toleration

Here is what I see under newpolicy@ trust relationships. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } I don't know how to edit this to have the app assume the role. Does it have to be something related to managed updates? – Audiogenic

This does not seem right to me, you have created a role for the EC2 to assume the service role, instead, you should create a role for the elastic beanstalk to assume the service role – Toleration

Found a role named AWSServiceRoleForElasticBeanstalk in my IAM roles menu, in it, I see policy with statement: "Principal": {"Service": "elasticbeanstalk.amazonaws.com" } Does this sound like the correct line to add to "Service" under newpolicy@ trust relationships? – Audiogenic

Should I then rebuild the environment after making this change? – Audiogenic

I wrote a details answer, please check and let me know if you still have any doubts. – Toleration

Answer 1

You created a service role name - newpolicy@ for the EC2 instance but it should be created for the Elastic Beanstalk to assume the service role.

Typically, Elastic Beanstalk requires two types of IAM roles: Service role and Instance profile.

Service role for Elastic Beanstalk Environment: The IAM role that Elastic Beanstalk assumes when calling other services on your behalf. When you launch an environment in the Elastic Beanstalk console or CLI, it creates a default service role that's named aws-elasticbeanstalk-service-role, and attaches managed policies with default permissions to this service role. If it doesn't exist or you'd prefer to utilize a different service role, you can create it by following the instructions below. If you already have a service role, make sure you have the below-required policies. To meet the default use cases for an environment, these policies must be attached to the role of the Elastic Beanstalk service role:-

1. In the navigation pane of the IAM console, choose Roles

2. And then choose Create role

3. Choose the AWS service role type as AWS Service

4. Choose the Use case as Elastic Beanstalk - Customizable

5. Choose Next → It should show two permission already selected - AWSElasticBeanstalkEnhancedHealth, AWSElasticBeanstalkService (Note: according to this AWS doc in the past, Elastic Beanstalk supported the AWSElasticBeanstalkService managed service role policy. This policy has been replaced by AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy. You might still be able to see and use the earlier policy in the IAM console. But AWS recommends using AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy, I will add this policy later once the role is created)

6. (Optional) Set a permissions boundary → Choose Next → Enter Role name as - aws-elasticbeanstalk-service-role → Review the role, and then choose Create role.

7. Now from the navigation pane of the IAM console, search for the newly created Role - aws-elasticbeanstalk-service-role → Click on Add permissions - Attach policies → Search and select AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy → Click Add permissions.

Permissions policies for the role - aws-elasticbeanstalk-service-role:

• AWSElasticBeanstalkEnhancedHealth
• AWSElasticBeanstalkService (old policy)
• AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy (new policy)

Trust relationships for the role - aws-elasticbeanstalk-service-role:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Service": "elasticbeanstalk.amazonaws.com"
        },
        "Action": "sts:AssumeRole",
        "Condition": {
          "StringEquals": {
            "sts:ExternalId": "elasticbeanstalk"
          }
        }
      }
    ]
}

---

Instance profile Role for EC2 Instances: The IAM role that's applied to Amazon EC2 instances that are launched in your Elastic Beanstalk environment. To allow the EC2 instances in your environment to assume the required role, the instance profile must specify Amazon EC2 as a trusted entity in the trust relationship policy. Please see this answer for instructions on how to properly set it.

Hope this helps.

Toleration

Trying this now. Should I terminate the environment, then delete the entire app and start from scratch, as I see no way of selecting a role for a pre-existing app? Or is there a better way? – Audiogenic

Now I am getting error saying instance profile aws-elasticbeanstalk-ec2-role associated with the environment does not exist. I can post screenshots of the details of new env I set up. I believe problem is I did not select an instance profile during environment creation and it defaulted to: aws-elastic-beanstalk-ec2-role – Audiogenic

@dennis, for the instance profile role, i would suggest to please follow the instructions mentioned here: https://mcmap.net/q/422940/-error-with-not-existing-instance-profile-while-trying-to-get-a-django-project-running-on-aws-beanstalk – Toleration

Thank you for your help. I now have an environment that uses aws-elastic-beanstalk-service-role for the service role, and the aws-elastic-beanstalk-ec2-role for the instance profile, and the app is condition OK. – Audiogenic

@ArpitJain AWSElasticBeanstalkService is not part of the option – Harpy

@olawalejuwonm, In the past, Elastic Beanstalk supported the AWSElasticBeanstalkService managed service role policy. This policy has been replaced by AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy as per this doc – Toleration

Answer 2

The tutorial is confusing. It tells the first-time user to "Use an existing service role" but doesn't provide the opportunity to select the default aws-elasticbeanstalk-service-role. If you choose "Create and use new service role", the default service role appears. You can then move down and create an EC2 instance profile as described in the tutorial.

Squamosal