Restrict AWS Elastic Beanstalk IAM Role to full access for one Application
<p>I am trying to grant to an IAM password user full access to an Elastic Beanstalk application (create/modify/delete environments). Following the AWS doc <a href="http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html" rel="nofollow noreferrer">here</a> results in the user being able to see the Application but being unable to view Environments or create new ones (message: Access Denied, without further specification).</p>

<p>Here is the current policy that is attached:</p>

<pre><code>{
"Version": "XXX-XX-XX",
"Statement": [
    {
        "Sid": "StmtXXXXXXXXX",
        "Effect": "Allow",
        "Action": [
            "elasticbeanstalk:*",
            "autoscaling:*"
        ],
        "Resource": [
            "arn:aws:elasticbeanstalk:eu-west-1:&lt;accountId&gt;:application/&lt;app-name&gt;",
            "arn:aws:elasticbeanstalk:eu-west-1:&lt;accountId&gt;:applicationversion/&lt;app-name&gt;",
            "arn:aws:elasticbeanstalk:eu-west-1:&lt;accountId&gt;:environment/&lt;app-name&gt;/*",
            "arn:aws:elasticbeanstalk:us-west-1::solutionstack/*"
        ]
    },
    {
        "Action": [
            "elasticbeanstalk:CheckDNSAvailability",
            "elasticbeanstalk:CreateStorageLocation",
            "autoscaling:DescribeAutoScalingGroups"
        ],
        "Effect": "Allow",
        "Resource": "*"
    }
]
</code></pre>

<p>}</p>

<p>Has anyone done this yet?</p>