How to fix the “aws-elasticbeanstalk-ec2-role” error in AWS Elastic Beanstalk.
Tags: aws, debug, elasticbeanstalk, iam
Published: 2024-04-01 09:38:35

If you're reading this, chances are you have encountered the "aws-elasticbeanstalk-ec2-role" error. This error message is usually caused by missing security configurations, associated with the EC2 instance that Elastic Beanstalk launches. 


![aws-elasticbeanstalk-ec2-role error screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ug7acp4mh0llj2gxbj7o.png)


In this guide, you will learn how to troubleshoot and fix the "aws-elasticbeanstalk-ec2-role" error.



## Prerequisites
To complete this guide, you'll need the following:

1. An [AWS](https://aws.amazon.com/) account. 
2. Some familiarity with [AWS IAM](https://aws.amazon.com/iam/) and [AWS Elastic Beanstalk](https://aws.amazon.com/elasticbeanstalk/). If you are not familiar with the following topics, check out these tutorials —  [Introduction to AWS Elastic Beanstalk](https://www.youtube.com/watch?v=uiM1xzOX8Qg) and [Lab 1 Introduction to AWS IAM](http://1. https://www.youtube.com/watch?v=ZNwdiYGIFrw).


## Understanding the "aws-elasticbeanstalk-ec2-role" error
It's important to understand the nature and cause of the error before attempting to solve it.

In AWS, instance profiles are used to give permissions to EC2 instances. If an instance profile lacks the necessary permissions or configurations, the associated EC2 instance will not have access to AWS resources like S3, RDS, DynamoDB, and much more. 

> An instance profile is a container for an AWS IAM role that you can assign to an EC2 instance. 




![An image depicting the relationship between an instance profile and an AWS service like EC2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a3ttnv8lvkaybkpgymel.png)


The "aws-elasticbeanstalk-ec2-role" error occurs while setting up an environment in the Elastic Beanstalk console. The error originates when you choose the **Create and use a new service role** option and do not provide an EC2 instance profile with the necessary permissions. It's important to note that this error is due to AWS security guidelines.
 


![AWS Configure service access page screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711845094282_18-mh+1.png)


Way back, AWS services like EC2 were allowed to create a default “aws-elasticbeanstalk-ec2-role” instance profile on the spot, but this practice has been changed in line with security best practices.


## How to fix the “aws-elasticbeanstalk-ec2-role” error

To fix the "aws-elasticbeanstalk-ec2-role" error, create an instance profile and assign it the necessary roles and permissions. 

Step 1. **Create a new role**: In this step, you will create a role. 

To create a role, visit the [IAM](https://us-east-1.console.aws.amazon.com/iam/home?region=eu-north-1#/home) page.


![The AWS IAM page screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711835983612_1-mh+1.png)


In the left-hand corner, under the **Access management** dropdown, click **Role** to create a role.

![AWS IAM Access management dropdown screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711836220049_10-mh-mh.png)


Once directed to the Roles page, click **Create role**.  

![AWS IAM Role page screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711836464803_3-mh.png)


To continue, keep the default **Trusted entity type** option. 

![AWS IAM ROLE Trust entity type option](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711836791804_4-mh.png)


In the **Service or use case** field, select EC2 and click **Next** to add permissions.

![AWS IAM Role Service or use case option](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711837255307_6-mh.png)


Step 2. **Add permissions**: After creating a role, you need to assign permissions to define the actions that the EC2 instance launched by Elastic Beanstalk can perform on AWS resources.

Search and select the following permissions listed below:

- AWSElasticBeanstalkWebTier
- AWSElasticBeanstalkWorkerTier
- AWSElasticBeanstalkMulticontainerDocker


![AWS Add Permission page screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711837356003_7-mh.png)



Once completed, click **Next**.

Step 3. **Review your details:** Once directed to the review page, enter a role name.


![AWS Review Role Details page screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711839936399_14-mh.png)


Scroll down to add a tag name, although this is optional. 

![AWS Review Role page: Add tag screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711838155158_13-mh.png)


Once you have filled out all the required information, carefully review your role details. If you are satisfied with them, click **Create Role** to complete the process. 


![AWS Instance profile](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711841459286_15-mh.png)

You have successfully created an instance profile. Now, verify the solution by setting up an environment in Elastic Beanstalk.

Step 4: **Setting up an Elastic Beanstalk environment:** Now that you have created an instance profile for the EC2 service. Set up an Elastic Beanstalk environment. 

> To ensure this guide stays focused on the intended subject matter, I will not cover all the steps required to set up an Elastic Beanstalk environment. I will proceed directly to the '_configure service access_' page. If you need guidance on how to set up an Elastic Beanstalk environment, I recommend checking out this video — [Deploy a Web Application Using Elastic Beanstalk](https://www.youtube.com/watch?v=2BoVhej0QVI)


In the "configure service access" page, select **Create and use new service role**. In the **EC2 instance profile**, field select the newly created instance profile. 

> Once you have filled out the other fields on the following pages, you can proceed to create your environment.

![AWS Elastic Beanstalk configure service access](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711847685095_is3JGSs_-mh.png)

Viola! The solution worked! 

![AWS Elastic Beanstalk successfully instance launch screenshot](https://paper-attachments.dropboxusercontent.com/s_7852F3DC9F2BB00ADEE2FD341EAD252FBEE61A25AF1741AC4A3C42E30F49F0CC_1711846171544_20-mh+1.png)

## Conclusion

In this guide, you learned how to fix the "aws-elasticbeanstalk-ec2-role" error in AWS Elastic Beanstalk. By understanding the causes of this error, such as misconfigured IAM roles or insufficient permissions, you can take appropriate steps to rectify this issue anytime it comes up.  

If you need any more help with debugging, don't hesitate to ask. Happy debugging 🛠️👩🏻‍💻, and have a fantastic day!