Actions, resources, and condition keys for Amazon Elastic Beanstalk
Amazon Elastic Beanstalk (service prefix: elasticbeanstalk) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
API operations defined by Amazon Elastic Beanstalk
The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.
| Operation | IAM action | Condition key | Possible value(s) | Access level |
|---|---|---|---|---|
|
DescribeEnvironments |
List |
Actions defined by Amazon Elastic Beanstalk
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in Amazon. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to cancel in-progress environment configuration update or application version deployment |
Write |
|||
Grants permission to add tags to an Elastic Beanstalk resource and to update tag values |
Tagging, Write |
|||
Grants permission to apply a scheduled managed action immediately |
Write |
|||
Grants permission to associate an operations role with an environment |
Write |
|||
Grants permission to check CNAME availability |
Read |
|||
Grants permission to create or update a group of environments, each running a separate component of a single application |
Write |
|||
Grants permission to create a new application |
Write |
|||
Grants permission to create an application version for an application |
Write |
|||
Grants permission to create a configuration template |
elasticbeanstalk:FromApplication elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate elasticbeanstalk:FromEnvironment |
Write |
||
Grants permission to launch an environment for an application |
elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate |
Write |
||
Grants permission to create a new version of a custom platform |
Write |
|||
Grants permission to create the Amazon S3 storage location for the account |
Write |
|||
Grants permission to delete an application along with all associated versions and configurations |
Write |
|||
Grants permission to delete an application version from an application |
Write |
|||
Grants permission to delete a configuration template |
Write |
|||
Grants permission to delete the draft configuration associated with the running environment |
Write |
|||
Grants permission to delete a version of a custom platform |
Write |
|||
Grants permission to retrieve a list of account attributes, including resource quotas |
Read |
|||
Grants permission to retrieve a list of application versions stored in an Amazon Elastic Beanstalk storage bucket |
List |
|||
Grants permission to retrieve the descriptions of existing applications |
List |
|||
Grants permission to retrieve descriptions of environment configuration options |
Read |
|||
Grants permission to retrieve a description of the settings for a configuration set |
Read |
|||
Grants permission to retrieve information about the overall health of an environment |
Read |
|||
Grants permission to retrieve a list of an environment's completed and failed managed actions |
Read |
|||
Grants permission to retrieve a list of an environment's upcoming and in-progress managed actions |
Read |
|||
Grants permission to retrieve a list of Amazon resources for an environment |
Read |
|||
Grants permission to retrieve descriptions for existing environments |
List |
|||
Grants permission to retrieve a list of event descriptions matching a set of criteria |
Read |
|||
Grants permission to retrieve more detailed information about the health of environment instances |
Read |
|||
Grants permission to retrieve a description of a managed platform version |
Read |
|||
Grants permission to disassociate an operations role with an environment |
Write |
|||
Grants permission to retrieve a list of the available solution stack names |
List |
|||
Grants permission to retrieve a list of the available platform branches |
List |
|||
Grants permission to retrieve a list of the available platforms |
List |
|||
Grants permission to retrieve a list of tags of an Elastic Beanstalk resource |
Read |
|||
Grants permission to submit instance statistics for enhanced health |
Write |
|||
Grants permission to delete and recreate all of the Amazon resources for an environment and to force a restart |
Write |
|||
Grants permission to remove tags from an Elastic Beanstalk resource |
Tagging, Write |
|||
Grants permission to initiate a request to compile information of the deployed environment |
Read |
|||
Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance |
Write |
|||
Grants permission to retrieve the compiled information from a RequestEnvironmentInfo request |
Read |
|||
Grants permission to swap the CNAMEs of two environments |
Write |
|||
Grants permission to terminate an environment |
Write |
|||
Grants permission to update an application with specified properties |
Write |
|||
Grants permission to update the application version lifecycle policy associated with the application |
Write |
|||
Grants permission to update an application version with specified properties |
Write |
|||
Grants permission to update a configuration template with specified properties or configuration option values |
elasticbeanstalk:FromApplication elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate elasticbeanstalk:FromEnvironment |
Write |
||
Grants permission to update an environment |
elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate |
Write |
||
Doesn't grant permission to update tags. To grant permission to add tags to an Elastic Beanstalk resource, remove tags, and to update tag values, specify elasticbeanstalk:AddTags and elasticbeanstalk:RemoveTags |
Tagging, Write |
|||
Grants permission to check the validity of a set of configuration settings for a configuration template or an environment |
Read |
|||
Resource types defined by Amazon Elastic Beanstalk
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:application/${ApplicationName} |
||
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:applicationversion/${ApplicationName}/${VersionLabel} |
||
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:configurationtemplate/${ApplicationName}/${TemplateName} |
||
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:environment/${ApplicationName}/${EnvironmentName} |
||
arn:${Partition}:elasticbeanstalk:${Region}::platform/${PlatformNameWithVersion} |
||
arn:${Partition}:elasticbeanstalk:${Region}::solutionstack/${SolutionStackName} |
Condition keys for Amazon Elastic Beanstalk
Amazon Elastic Beanstalk defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters actions based on the presence of tag key-value pairs in the request |
String |
|
Filters actions based on tag key-value pairs attached to the resource |
String |
|
Filters actions based on the presence of tag keys in the request |
ArrayOfString |
|
Filters access by an application as a dependency or a constraint on an input parameter |
ARN |
|
Filters access by an application version as a dependency or a constraint on an input parameter |
ARN |
|
Filters access by a configuration template as a dependency or a constraint on an input parameter |
ARN |
|
Filters access by an environment as a dependency or a constraint on an input parameter |
ARN |
|
Filters access by a platform as a dependency or a constraint on an input parameter |
ARN |
|
Filters access by a solution stack as a dependency or a constraint on an input parameter |
ARN |
|
Filters access by the application that contains the resource that the action operates on |
ARN |