CodeDeploy necesary IAM Roles

AWS CodeDeployPolicy

CodeDeploy Trust Role

This Role is attached to CD Deployment Group or to the CD App when is created.

In the Inline Policies of the Role must be added a Policy called CodeDeployPolicy as follows:

{
    "Statement": [
        {
            "Resource": [
                "*"
            ],
            "Action": [
                "ec2:Describe*"
            ],
            "Effect": "Allow"
        },
        {
            "Resource": [
                "*"
            ],
            "Action": [
                "autoscaling:CompleteLifecycleAction",
                "autoscaling:DeleteLifecycleHook",
                "autoscaling:DescribeLifecycleHooks",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:PutLifecycleHook",
                "autoscaling:RecordLifecycleActionHeartbeat"
            ],
            "Effect": "Allow"
        },
        {
            "Resource": [
                "*"
            ],
            "Action": [
                "Tag:getResources",
                "Tag:getTags",
                "Tag:getTagsForResource",
                "Tag:getTagsForResourceList"
            ],
            "Effect": "Allow"
        }
    ]
}

And the Trust Relationships must be as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "codedeploy.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

CodeDeployInstanceRole

CodeDeploy Instance Role

This Role is the one that creates and manage the instences to be deployed. 
The instance must be launched with this Role as IAM Role for EC2. 
On the Select Role Type page, choose Select next to Amazon EC2.
On the Attach Policy page select PowerUserAccess

In the Inline Policies of the Role must be added a Policy called InstanceRole as follows:

{
    "Statement": [
        {
            "Resource": "*",
            "Action": [
                "autoscaling:Describe*",
                "cloudformation:Describe*",
                "cloudformation:GetTemplate",
                "s3:Get*"
            ],
            "Effect": "Allow"
        }
    ]
}

And the Trust Relationships must be as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "codedeploy.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}