AWS CodeDeploy在Windows Server 2016部署时卡在ApplicationStop前求助

I’ve run into nearly identical issues with CodeDeploy on Windows Server EC2 instances before, so let’s walk through targeted fixes based on what you’ve already checked:

1. First, Dig into CodeDeploy Agent Logs #

Windows stores CodeDeploy Agent logs at C:\ProgramData\Amazon\CodeDeploy\logs\codedeploy-agent.log — this is your most critical resource for pinpointing the root cause. Look for errors like:

• YAML parsing failures (super common with Windows path characters)
• Permission issues accessing the deployment package
• Failed API calls to the CodeDeploy service (indicates IAM/network problems)

Use PowerShell to quickly view recent log entries:

Get-Content "C:\ProgramData\Amazon\CodeDeploy\logs\codedeploy-agent.log" -Tail 100

2. Fix Appspec.yml Syntax for Windows #

Your appspec has two Windows-specific syntax issues that Linux environments ignore:

Path Escaping #

In YAML, backslashes (\) are treated as escape characters. Your current source: \path and destination: \path are invalid — you need to double the backslashes:

files:
  - source: \\path
    destination: \\path

Empty Hook Definitions #

Leaving hooks like BeforeInstall: with no content breaks YAML parsing on Windows. Since you only need to sync files, either:

• Remove the entire hooks section (cleanest option), or
• Define empty lists for each hook to satisfy YAML syntax rules:

hooks:
  BeforeInstall: []
  AfterInstall: []
  ApplicationStart: []

3. Verify EC2 Instance IAM Role & Metadata Access #

Even if your IAM role has full permissions, the instance might not be able to retrieve credentials:

• Confirm the correct IAM role is attached to your EC2 instance via the AWS Console.
• Test metadata access in PowerShell — if this returns an error or empty result, your instance can’t reach the metadata service (check VPC security groups for outbound access to 169.254.169.254):

Invoke-RestMethod -Uri http://169.254.169.254/latest/meta-data/iam/security-credentials/

4. Update the CodeDeploy Agent to the Latest Version #

Older Windows Agent versions have known compatibility bugs. Run this silent install command (replace the region URL with your instance’s AWS region):

msiexec.exe /i https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/codedeploy-agent.msi /quiet

Then restart the agent:

Restart-Service codedeployagent

5. Check System Time Synchronization #

Windows instances with incorrect system time fail SSL certificate validation when communicating with CodeDeploy. Verify sync status:

w32tm /query /status

If out of sync, reset to use public NTP servers:

w32tm /config /syncfromflags:manual /manualpeerlist:"pool.ntp.org" /update
w32tm /resync

6. Confirm Deployment Package Structure #

Ensure your appspec.yml is in the root of your deployment zip file, not nested inside a subfolder. Windows zip tools often wrap content in a parent folder, which makes CodeDeploy unable to locate the appspec.

内容的提问来源于stack exchange，提问作者Aleksandar