Actions, resources, and condition keys for AWS Elastic Beanstalk

AWS Elastic Beanstalk (service prefix: elasticbeanstalk) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by AWS Elastic Beanstalk
Resource types defined by AWS Elastic Beanstalk
Condition keys for AWS Elastic Beanstalk

Actions defined by AWS Elastic Beanstalk

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
AbortEnvironmentUpdate	Grants permission to cancel in-progress environment configuration update or application version deployment	Write	environment*	elasticbeanstalk:InApplication
AddTags	Grants permission to add tags to an Elastic Beanstalk resource and to update tag values	Tagging	application
			applicationversion
			configurationtemplate
			environment
			platform
				aws:RequestTag/${TagKey} aws:TagKeys
ApplyEnvironmentManagedAction	Grants permission to apply a scheduled managed action immediately	Write	environment*	elasticbeanstalk:InApplication
AssociateEnvironmentOperationsRole	Grants permission to associate an operations role with an environment	Write	environment*
CheckDNSAvailability	Grants permission to check CNAME availability	Read
ComposeEnvironments	Grants permission to create or update a group of environments, each running a separate component of a single application	Write	application*
ComposeEnvironments		Write	applicationversion*	elasticbeanstalk:InApplication
CreateApplication	Grants permission to create a new application	Write	application*
CreateApplication	Grants permission to create a new application	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateApplicationVersion	Grants permission to create an application version for an application	Write	application*
CreateApplicationVersion		Write	applicationversion*	elasticbeanstalk:InApplication aws:RequestTag/${TagKey} aws:TagKeys
CreateConfigurationTemplate	Grants permission to create a configuration template	Write	configurationtemplate*	elasticbeanstalk:InApplication
CreateConfigurationTemplate	Grants permission to create a configuration template	Write		elasticbeanstalk:FromApplication elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate elasticbeanstalk:FromEnvironment elasticbeanstalk:FromSolutionStack elasticbeanstalk:FromPlatform aws:RequestTag/${TagKey} aws:TagKeys
CreateEnvironment	Grants permission to launch an environment for an application	Write	environment*	elasticbeanstalk:InApplication
CreateEnvironment		Write		elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate elasticbeanstalk:FromSolutionStack elasticbeanstalk:FromPlatform aws:RequestTag/${TagKey} aws:TagKeys
CreatePlatformVersion	Grants permission to create a new version of a custom platform	Write	platform*
CreatePlatformVersion		Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateStorageLocation	Grants permission to create the Amazon S3 storage location for the account	Write
DeleteApplication	Grants permission to delete an application along with all associated versions and configurations	Write	application*
DeleteApplicationVersion	Grants permission to delete an application version from an application	Write	applicationversion*	elasticbeanstalk:InApplication
DeleteConfigurationTemplate	Grants permission to delete a configuration template	Write	configurationtemplate*	elasticbeanstalk:InApplication
DeleteEnvironmentConfiguration	Grants permission to delete the draft configuration associated with the running environment	Write	environment*	elasticbeanstalk:InApplication
DeletePlatformVersion	Grants permission to delete a version of a custom platform	Write	platform*
DescribeAccountAttributes	Grants permission to retrieve a list of account attributes, including resource quotas	Read
DescribeApplicationVersions	Grants permission to retrieve a list of application versions stored in an AWS Elastic Beanstalk storage bucket	List	applicationversion	elasticbeanstalk:InApplication
DescribeApplications	Grants permission to retrieve the descriptions of existing applications	List	application
DescribeConfigurationOptions	Grants permission to retrieve descriptions of environment configuration options	Read	configurationtemplate	elasticbeanstalk:InApplication
			environment	elasticbeanstalk:InApplication
			solutionstack
DescribeConfigurationSettings	Grants permission to retrieve a description of the settings for a configuration set	Read	configurationtemplate	elasticbeanstalk:InApplication
DescribeConfigurationSettings		Read	environment	elasticbeanstalk:InApplication
DescribeEnvironmentHealth	Grants permission to retrieve information about the overall health of an environment	Read	environment
DescribeEnvironmentManagedActionHistory	Grants permission to retrieve a list of an environment's completed and failed managed actions	Read	environment	elasticbeanstalk:InApplication
DescribeEnvironmentManagedActions	Grants permission to retrieve a list of an environment's upcoming and in-progress managed actions	Read	environment	elasticbeanstalk:InApplication
DescribeEnvironmentResources	Grants permission to retrieve a list of AWS resources for an environment	Read	environment	elasticbeanstalk:InApplication
DescribeEnvironments	Grants permission to retrieve descriptions for existing environments	List	environment	elasticbeanstalk:InApplication
DescribeEvents	Grants permission to retrieve a list of event descriptions matching a set of criteria	Read	application
			applicationversion	elasticbeanstalk:InApplication
			configurationtemplate	elasticbeanstalk:InApplication
			environment	elasticbeanstalk:InApplication
DescribeInstancesHealth	Grants permission to retrieve more detailed information about the health of environment instances	Read	environment
DescribePlatformVersion	Grants permission to retrieve a description of a managed platform version	Read	platform
DisassociateEnvironmentOperationsRole	Grants permission to disassociate an operations role with an environment	Write	environment*
ListAvailableSolutionStacks	Grants permission to retrieve a list of the available solution stack names	List	solutionstack
ListPlatformBranches	Grants permission to retrieve a list of the available platform branches	List
ListPlatformVersions	Grants permission to retrieve a list of the available platforms	List	platform
ListTagsForResource	Grants permission to retrieve a list of tags of an Elastic Beanstalk resource	Read	application
			applicationversion
			configurationtemplate
			environment
			platform
PutInstanceStatistics	Grants permission to submit instance statistics for enhanced health	Write	application*
PutInstanceStatistics		Write	environment*
RebuildEnvironment	Grants permission to delete and recreate all of the AWS resources for an environment and to force a restart	Write	environment*	elasticbeanstalk:InApplication
RemoveTags	Grants permission to remove tags from an Elastic Beanstalk resource	Tagging	application
			applicationversion
			configurationtemplate
			environment
			platform
				aws:TagKeys
RequestEnvironmentInfo	Grants permission to initiate a request to compile information of the deployed environment	Read	environment*	elasticbeanstalk:InApplication
RestartAppServer	Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance	Write	environment*	elasticbeanstalk:InApplication
RetrieveEnvironmentInfo	Grants permission to retrieve the compiled information from a RequestEnvironmentInfo request	Read	environment*	elasticbeanstalk:InApplication
SwapEnvironmentCNAMEs	Grants permission to swap the CNAMEs of two environments	Write	environment*	elasticbeanstalk:InApplication
SwapEnvironmentCNAMEs	Grants permission to swap the CNAMEs of two environments	Write		elasticbeanstalk:FromEnvironment
TerminateEnvironment	Grants permission to terminate an environment	Write	environment*	elasticbeanstalk:InApplication
UpdateApplication	Grants permission to update an application with specified properties	Write	application*
UpdateApplicationResourceLifecycle	Grants permission to update the application version lifecycle policy associated with the application	Write	application*
UpdateApplicationVersion	Grants permission to update an application version with specified properties	Write	applicationversion*	elasticbeanstalk:InApplication
UpdateConfigurationTemplate	Grants permission to update a configuration template with specified properties or configuration option values	Write	configurationtemplate*	elasticbeanstalk:InApplication
UpdateConfigurationTemplate		Write		elasticbeanstalk:FromApplication elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate elasticbeanstalk:FromEnvironment elasticbeanstalk:FromSolutionStack elasticbeanstalk:FromPlatform
UpdateEnvironment	Grants permission to update an environment	Write	environment*	elasticbeanstalk:InApplication
UpdateEnvironment	Grants permission to update an environment	Write		elasticbeanstalk:FromApplicationVersion elasticbeanstalk:FromConfigurationTemplate elasticbeanstalk:FromSolutionStack elasticbeanstalk:FromPlatform
UpdateTagsForResource	Doesn't grant permission to update tags. To grant permission to add tags to an Elastic Beanstalk resource, remove tags, and to update tag values, specify elasticbeanstalk:AddTags and elasticbeanstalk:RemoveTags	Tagging	application
			applicationversion
			configurationtemplate
			environment
			platform
				aws:RequestTag/${TagKey} aws:TagKeys
ValidateConfigurationSettings	Grants permission to check the validity of a set of configuration settings for a configuration template or an environment	Read	configurationtemplate	elasticbeanstalk:InApplication
ValidateConfigurationSettings		Read	environment	elasticbeanstalk:InApplication

Resource types defined by AWS Elastic Beanstalk

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
application	`arn:${Partition}:elasticbeanstalk:${Region}:${Account}:application/${ApplicationName}`	aws:ResourceTag/${TagKey}
applicationversion	`arn:${Partition}:elasticbeanstalk:${Region}:${Account}:applicationversion/${ApplicationName}/${VersionLabel}`	aws:ResourceTag/${TagKey} elasticbeanstalk:InApplication
configurationtemplate	`arn:${Partition}:elasticbeanstalk:${Region}:${Account}:configurationtemplate/${ApplicationName}/${TemplateName}`	aws:ResourceTag/${TagKey} elasticbeanstalk:InApplication
environment	`arn:${Partition}:elasticbeanstalk:${Region}:${Account}:environment/${ApplicationName}/${EnvironmentName}`	aws:ResourceTag/${TagKey} elasticbeanstalk:InApplication
solutionstack	`arn:${Partition}:elasticbeanstalk:${Region}::solutionstack/${SolutionStackName}`
platform	`arn:${Partition}:elasticbeanstalk:${Region}::platform/${PlatformNameWithVersion}`

Condition keys for AWS Elastic Beanstalk

AWS Elastic Beanstalk defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters actions based on the presence of tag keys in the request	ArrayOfString
elasticbeanstalk:FromApplication	Filters access by an application as a dependency or a constraint on an input parameter	ARN
elasticbeanstalk:FromApplicationVersion	Filters access by an application version as a dependency or a constraint on an input parameter	ARN
elasticbeanstalk:FromConfigurationTemplate	Filters access by a configuration template as a dependency or a constraint on an input parameter	ARN
elasticbeanstalk:FromEnvironment	Filters access by an environment as a dependency or a constraint on an input parameter	ARN
elasticbeanstalk:FromPlatform	Filters access by a platform as a dependency or a constraint on an input parameter	ARN
elasticbeanstalk:FromSolutionStack	Filters access by a solution stack as a dependency or a constraint on an input parameter	ARN
elasticbeanstalk:InApplication	Filters access by the application that contains the resource that the action operates on	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon EKS Auth

Amazon Elastic Block Store