Skip to content

Instantly share code, notes, and snippets.

@rhysgodfrey
Last active December 12, 2017 16:36
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 3 You must be signed in to fork a gist
  • Save rhysgodfrey/1f1e8810141a52477c06 to your computer and use it in GitHub Desktop.
Save rhysgodfrey/1f1e8810141a52477c06 to your computer and use it in GitHub Desktop.
{
"Version":"2012-10-17",
"Statement":[
{
"Sid":"ElasticBeanstalkEnvironmentPermissions",
"Effect":"Allow",
"Action":[
"elasticbeanstalk:DescribeEnvironmentResources",
"elasticbeanstalk:DescribeEnvironments",
"elasticbeanstalk:DescribeEvents",
"elasticbeanstalk:RestartAppServer",
"elasticbeanstalk:RetrieveEnvironmentInfo",
"elasticbeanstalk:SwapEnvironmentCNAMEs",
"elasticbeanstalk:UpdateEnvironment",
"elasticbeanstalk:RequestEnvironmentInfo"
],
"Resource":[
"arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:environment/ApplicationName/*"
]
},
{
"Sid":"ElasticBeanstalkGlobalPermissions",
"Effect":"Allow",
"Action":[
"elasticbeanstalk:DescribeConfigurationOptions",
"elasticbeanstalk:DescribeConfigurationSettings",
"elasticbeanstalk:ListAvailableSolutionStacks",
"elasticbeanstalk:ValidateConfigurationSettings",
"elasticbeanstalk:CheckDNSAvailability",
"elasticbeanstalk:CreateStorageLocation"
],
"Resource":[
"*"
]
},
{
"Sid":"ElasticBeanstalkApplicationVersionPermissions",
"Effect":"Allow",
"Action":[
"elasticbeanstalk:CreateApplicationVersion",
"elasticbeanstalk:DescribeApplicationVersions",
"elasticbeanstalk:UpdateApplicationVersion"
],
"Resource":[
"arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:applicationversion/ApplicationName/*"
]
},
{
"Sid":"ElasticBeanstalkApplicationPermissions",
"Effect":"Allow",
"Action":[
"elasticbeanstalk:DescribeApplications",
"elasticbeanstalk:UpdateApplication"
],
"Resource":[
"arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:application/ApplicationName"
]
},
{
"Sid":"Autoscaling",
"Effect":"Allow",
"Action":[
"autoscaling:SuspendProcesses",
"autoscaling:Describe*",
"autoscaling:ResumeProcesses"
],
"Resource":"*"
},
{
"Sid":"Cloudwatch",
"Effect":"Allow",
"Action":[
"cloudwatch:Describe*",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource":"*"
},
{
"Sid":"Cloudformation",
"Effect":"Allow",
"Action":[
"cloudformation:GetTemplate",
"cloudformation:Describe*"
],
"Resource":"*"
},
{
"Sid":"IAM",
"Effect":"Allow",
"Action":[
"iam:ListServerCertificates",
"iam:ListInstanceProfiles"
],
"Resource":"*"
},
{
"Sid":"S3ElasticBeanstalkBucket",
"Action":[
"s3:AbortMultipartUpload",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketNotification",
"s3:GetBucketPolicy",
"s3:GetBucketRequestPayment",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetLifecycleConfiguration",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:GetObjectTorrent",
"s3:GetObjectVersion",
"s3:GetObjectVersionAcl",
"s3:GetObjectVersionTorrent",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:ListBucket",
"s3:GetObject",
"s3:DeleteObject"
],
"Effect":"Allow",
"Resource":[
"arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx",
"arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx/*"
]
},
{
"Sid":"S3Global",
"Effect":"Allow",
"Action":"s3:ListAllMyBuckets",
"Resource":"arn:aws:s3:::*"
},
{
"Sid":"S3ElasticBeanstalkShared",
"Effect":"Allow",
"Action":"s3:*",
"Resource":[
"arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1",
"arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1/*"
]
},
{
"Sid":"EC2Global",
"Effect":"Allow",
"Action":[
"ec2:Describe*"
],
"Resource":[
"*"
]
}
]
}
@Rob-B1
Copy link

Rob-B1 commented Jun 14, 2016

I was about 90% down this path before i found this. It really is better than AWS's documentation. I am implementing name filters and other resource permissions to try and isolate projects teams as much as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment