I am deploying with this IAM using Codeship and Circle CI to Elastic Beanstalk. I had a lot of trouble with this config. I talked to the aws support for about 6 hours until this worked properly, so, I guess it is worth to share.
UPDATE: In the end, I have to use the AWSElasticBeanstalkFullAccess policy. My custom policy keep breaking every week with some new added permission or some EB internal change. Anyway, the IAM I was using is below.
This works for me with CircleCI and EB Cli.
{
"Version": "2012-10-17",
"Statement": [
{