Skip to content

Instantly share code, notes, and snippets.

@tomfa
Last active February 13, 2020 14:30
Show Gist options
  • Save tomfa/fbc6455623defedb254b6c2252ba1721 to your computer and use it in GitHub Desktop.
Save tomfa/fbc6455623defedb254b6c2252ba1721 to your computer and use it in GitHub Desktop.
Beanstalk EC2 instance profile policies
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ECSAccess",
"Effect": "Allow",
"Action": [
"ecs:Poll",
"ecs:StartTask",
"ecs:StopTask",
"ecs:DiscoverPollEndpoint",
"ecs:StartTelemetrySession",
"ecs:RegisterContainerInstance",
"ecs:DeregisterContainerInstance",
"ecs:DescribeContainerInstances",
"ecs:Submit*",
"ecs:DescribeTasks"
],
"Resource": "*"
}
]
}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "BucketAccess",
"Action": [
"s3:Get*",
"s3:List*",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::elasticbeanstalk-*",
"arn:aws:s3:::elasticbeanstalk-*/*"
]
}
]
}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "MetricsAccess",
"Action": [
"cloudwatch:PutMetricData"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Sid": "QueueAccess",
"Action": [
"sqs:ChangeMessageVisibility",
"sqs:DeleteMessage",
"sqs:ReceiveMessage",
"sqs:SendMessage"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Sid": "BucketAccess",
"Action": [
"s3:Get*",
"s3:List*",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::elasticbeanstalk-*",
"arn:aws:s3:::elasticbeanstalk-*/*"
]
},
{
"Sid": "DynamoPeriodicTasks",
"Action": [
"dynamodb:BatchGetItem",
"dynamodb:BatchWriteItem",
"dynamodb:DeleteItem",
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:UpdateItem"
],
"Effect": "Allow",
"Resource": [
"arn:aws:dynamodb:*:*:table/*-stack-AWSEBWorkerCronLeaderRegistry*"
]
}
]
}
@tomfa
Copy link
Author

tomfa commented Oct 16, 2016

Necessary policies for EC2 instance profile when creating a Beanstalk App. This is autogenerated by cli, but needs to be specified if using Terraform. The policies are premade by AWS and can also be accessed using the following arns:

  • arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
  • arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
  • arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker

Article at

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment