CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2amazon-elastic-beanstalkrolesamazon-iam
jvataman
jvataman

Reputation: 498

Restrict AWS Elastic Beanstalk IAM Role to full access for one Application

I am trying to grant to an IAM password user full access to an Elastic Beanstalk application (create/modify/delete environments). Following the AWS doc here results in the user being able to see the Application but being unable to view Environments or create new ones (message: Access Denied, without further specification).

Here is the current policy that is attached:

{
"Version": "XXX-XX-XX",
"Statement": [
    {
        "Sid": "StmtXXXXXXXXX",
        "Effect": "Allow",
        "Action": [
            "elasticbeanstalk:*",
            "autoscaling:*"
        ],
        "Resource": [
            "arn:aws:elasticbeanstalk:eu-west-1:<accountId>:application/<app-name>",
            "arn:aws:elasticbeanstalk:eu-west-1:<accountId>:applicationversion/<app-name>",
            "arn:aws:elasticbeanstalk:eu-west-1:<accountId>:environment/<app-name>/*",
            "arn:aws:elasticbeanstalk:us-west-1::solutionstack/*"
        ]
    },
    {
        "Action": [
            "elasticbeanstalk:CheckDNSAvailability",
            "elasticbeanstalk:CreateStorageLocation",
            "autoscaling:DescribeAutoScalingGroups"
        ],
        "Effect": "Allow",
        "Resource": "*"
    }
]

}

Has anyone done this yet?

Upvotes: 0

Views: 1502

Answers (1)

Gustaf
Gustaf

Reputation: 1349

This is what I use. I couldn't be asked to go further in separating it. You can use tags for as well.

What I have done more is to run more and more things in separate accounts. If there are separate apps there are little or no reason to have them in the same account anyway. You can have cross account access for users. https://aws.amazon.com/blogs/security/how-to-enable-cross-account-access-to-the-aws-management-console/

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "elasticloadbalancing:Describe*",
                "autoscaling:Describe*",
                "cloudwatch:Describe*",
                "cloudwatch:List*",
                "cloudwatch:Get*",
                "s3:Get*",
                "s3:List*",
                "sns:Get*",
                "sns:List*",
                "cloudformation:Describe*",
                "cloudformation:Get*",
                "cloudformation:List*",
                "cloudformation:Validate*",
                "cloudformation:Estimate*",
                "rds:Describe*",
                "elasticbeanstalk:CreateStorageLocation",
                "sqs:Get*",
                "sqs:List*",
                "autoscaling:SuspendProcesses",
                "autoscaling:ResumeProcesses",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:DescribeAutoScalingGroups",
                "cloudformation:UpdateStack",
                "cloudformation:DescribeStacks",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupIngress",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer"
            ],
            "Resource": [
                "arn:aws:elasticloadbalancing:eu-west-1:12345678910:loadbalancer/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticbeanstalk:Check*",
                "elasticbeanstalk:Describe*",
                "elasticbeanstalk:List*",
                "elasticbeanstalk:RequestEnvironmentInfo",
                "elasticbeanstalk:RetrieveEnvironmentInfo",
                "elasticbeanstalk:CreateApplicationVersion",
                "elasticbeanstalk:CreateConfigurationTemplate",
                "elasticbeanstalk:UpdateApplicationVersion",
                "elasticbeanstalk:UpdateConfigurationTemplate",
                "elasticbeanstalk:UpdateEnvironment",
                "elasticbeanstalk:DescribeEnvironmentResources",
                "elasticbeanstalk:ValidateConfigurationSettings"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringEquals": {
                    "elasticbeanstalk:InApplication": [
                        "arn:aws:elasticbeanstalk:eu-west-1:12345678910:application/My App"
                    ]
                }
            }
        }
    ]
}

Upvotes: 2

Related Questions