Elastic Beanstalk Deployment Stuck While Updating Configuration Settings

Question

I tested my continuous deployment setup, trying to get the minimum set of IAM permissions that would allow my CI group II to deploy in my "staging" environment with an elastic beanstalk.

In my last test, my deployment was stuck. Last event in the console:

Updating environment staging configuration settings. 

Fortunately, deployment will be turned off after 30 minutes, so the environment can be deployed again.

This seems to be a permissions issue, because if I provide s3:* for all resources, the deployment works. It seems that when calling UpdateEnvironment, Elastic Beanstalk does something on S3, but I can't figure that out.

I tried the following policy to give EB full access to my resource:

 { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/_runtime/_embedded_extensions/APP", "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/_runtime/_embedded_extensions/APP/*", "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/environments/ENV_ID", "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/environments/ENV_ID/*" ] } ] } 

Where REGION , ACCOUNT , APP and ENV_ID are my AWS area, account number, application name, and environment identifier, respectively.

Does anyone have a key that the S3 action and EB resource are trying to access?

Answer 1

Sharing this on your blog already , but it may have a wider audience, so here it is:

Following this, the ElastiBeanstalk team provided me with the following answer regarding S3 permissions:

"[...] Having seen the requirement below, will the slightly blocked version work? I have attached a policy to this case that will provide s3: GetObject on buckets, starting with elastic material. This will essentially allow access to all elastic buckets in including the ones we have. The only thing you need to do with our bucket is GetObject, so that should be enough to do everything you need. "

So, it looks like ElasticBeanstalk is accessing buckets from any world to work correctly (which is bad, but it is as it is).

Based on this, the following policy will be enough to make things work with S3:

 { "Action": "s3:*", "Resource": [ "arn:aws:s3:::elasticbeanstalk-<region>-<account_id>", "arn:aws:s3:::elasticbeanstalk-<region>-<account_id>/", "arn:aws:s3:::elasticbeanstalk-<region>-<account_id>/*" ], "Effect": "Allow" }, { "Action": "s3:GetObject", "Resource": "arn:aws:s3:::elasticbeanstalk*", "Effect": "Allow" } 

Obviously, you need to wrap this in the correct policy expression that IAM understands. All of your previous assumptions about IAM policy have proven to be true, although I assume this should not be a problem.