Elasticbeanstalk IAM policies

iampolicies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387278083000",
      "Effect": "Allow",
      "Action": [
        "elasticbeanstalk:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387278213000",
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387278333000",
      "Effect": "Allow",
      "Action": [
        "ec2:*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:Region": "us-east-1"
        }
      },
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387279354000",
      "Effect": "Allow",
      "Action": [
        "iam:ListInstanceProfiles"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387279943000",
      "Effect": "Allow",
      "Action": [
        "cloudformation:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387280521000",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387280999000",
      "Effect": "Allow",
      "Action": [
        "autoscaling:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1387281526000",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

https://loopco.signin.aws.amazon.com/console

2013-12-18 15:49:21 UTC-0800 INFO terminateEnvironment is starting.
2013-12-18 15:40:16 UTC-0800 INFO Launched environment: LoopBee. However, there were issues during launch. See event log for details.
2013-12-18 15:40:09 UTC-0800 ERROR Stack named 'awseb-e-tchmtc9erv-stack' aborted operation. Current state: 'CREATE_FAILED' Reason: The following resource(s) failed to create: [AWSEBSecurityGroupSSHIngress, AWSEBAutoScalingLaunchConfiguration].
2013-12-18 15:37:11 UTC-0800 ERROR Creating security group ingress failed Reason: Resource creation cancelled
2013-12-18 15:37:03 UTC-0800 ERROR Creating Auto Scaling launch configuration failed Reason: API: autoscaling:CreateLaunchConfiguration User: arn:aws:iam::486466979912:user/dmourati is not authorized to perform: iam:PassRole on resource: arn:aws:iam::486466979912:role/aws-elasticbeanstalk-ec2-role

Also got this error when using an IAM role with the User Policy template for "AWS Elastic Beanstalk Full Access" attached. Ref. http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.roles.aeb.html, adding the following entries resolved the error:

    "iam:AddRoleToInstanceProfile",
    "iam:CreateInstanceProfile",
    "iam:CreateRole",
    "iam:PassRole",
    "iam:ListInstanceProfiles"

Be careful to review the security implications of these permissions to make sure they align with your local role security policies.

Thanks for the suggestion @slowbluecamera, we've been running into that error and it's fixed it for us.