My main pain point with deployment is with servers that are not directly accessible from the Internet. For example, an EC2 instance that sits in a private section of an AWS VPC. Accessing the server is done through a Bastion server/Jumpbox. AWS CodeDeploy is the only solution I've found in this environment and it sucks. Can the new system ssh proxy through a Bastion server?
At the moment, direct access to your Amazon resources requires an access key configured via secure variables in Pipelines. We'd consider adding support for IAM roles/key rotation if a lot of people would find it useful.