title: AWS Codedploy Agent Access denied from EC2 instance to S3
body: <p>I have set up the Codedeploy Agent, however when I run it, I get the error:</p>
  
  <pre><code>Error: HEALT_CONSTRAINTS
  </code></pre>
  
  <p>By going further , this is the entry in the code deploy log from the EC2 instance:</p>
  
  <pre><code>InstanceAgent::Plugins::CodeDeployPlugin::CommandPoller: Cannot reach InstanceService: Aws::S3::Errors::AccessDenied - Access Denied
  </code></pre>
  
  <p>I have done a simple <code>wget</code> from the bucket and it results:</p>
  
  <pre><code>Connecting to s3-us-west-2.amazonaws.com (s3-us-west-2.amazonaws.com)|xxxxxxxxx|:443... connected.
  HTTP request sent, awaiting response... 403 Forbidden
  </code></pre>
  
  <p>On the opposite, if I use the AWS cli I can correctly reach the S3 bucket.</p>
  
  <p>The EC2 instance is on a VPC, it has a role associated with full permission on S3, firewall settings inbound and outbound seem correct. So it is obviously something related to permissions in accessing from https.</p>
  
  <p>The questions:</p>
  
  <ol>
  <li>Under which credentials Code Deploy Agent runs ?</li>
  <li>What permissions or roles have to be set on S3 bucket ?</li>
  </ol>