AWSElasticBeanstalkServiceRolePolicy
Last Modified
Aug 18, 2026
August 18, 2026 at 06:03 PM UTC
Version
v8
Total Versions
9
Created
Aug 18, 2026
Actions
132
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:ResourceAccount, iam:PassedToService
- cloudformation:CreateStack: condition aws:ResourceAccount, on arn:aws:cloudformation:*:*:stack/elasticbeanstalk-*-image-build, arn:aws:cloudformation:*:*:stack/elasticbeanstalk-*-image-build/*
- iam:PassRole: condition aws:ResourceAccount, iam:PassedToService
- codebuild:CreateProject: condition aws:ResourceAccount, on arn:aws:codebuild:*:*:project/elasticbeanstalk-*
- codebuild:StartBuild: condition aws:ResourceAccount, on arn:aws:codebuild:*:*:project/elasticbeanstalk-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: condition aws:ResourceAccount, on arn:aws:cloudformation:*:*:stack/elasticbeanstalk-*-image-build, arn:aws:cloudformation:*:*:stack/elasticbeanstalk-*-image-build/*
- codebuild:StartBuild: condition aws:ResourceAccount, on arn:aws:codebuild:*:*:project/elasticbeanstalk-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (2)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 11581 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::elasticbeanstalk-*/* to remove the redundancy. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudformationReadOperationsOnElasticBeanstalkStacks",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStacks"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/awseb-*",
"arn:aws:cloudformation:*:*:stack/eb-*"
]
},
{
"Sid": "AllowOperations",
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeAutoScalingInstances",
"autoscaling:DescribeNotificationConfigurations",
"autoscaling:DescribeScalingActivities",
"autoscaling:PutNotificationConfiguration",
"ec2:DescribeInstanceStatus",
"ec2:AssociateAddress",
"ec2:DescribeAddresses",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroups",
"elasticloadbalancing:DescribeInstanceHealth",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTargetGroups",
"lambda:GetFunction",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sns:Publish"
],
"Resource": [
"*"
]
},
{
"Sid": "AllowOperationsOnHealthStreamingLogs",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:DeleteLogGroup",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*"
},
{
"Sid": "EBEKSGeneralOperations",
"Effect": "Allow",
"Action": [
"acm:DescribeCertificate",
"acm:ListCertificates",
"acm:ListTagsForCertificate",
"ec2:DescribeRouteTables",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeSecurityGroups",
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer",
"ecr:DescribeRepositories",
"ecr:ListTagsForResource",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTargetGroups",
"iam:GetRole",
"codebuild:ListProjects",
"codebuild:BatchGetProjects",
"tag:GetResources",
"tag:TagResources",
"tag:UntagResources",
"elasticbeanstalk:DescribeEvents",
"elasticbeanstalk:DescribeEnvironments",
"elasticbeanstalk:DescribeConfigurationSettings"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSDefaultHTTPSCertCreate",
"Effect": "Allow",
"Action": [
"acm:RequestCertificate"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:RequestTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSDefaultHTTPSCertModifyDelete",
"Effect": "Allow",
"Action": [
"acm:AddTagsToCertificate",
"acm:DeleteCertificate"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSSubnetTag",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:subnet/*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"kubernetes.io/role/elb",
"kubernetes.io/role/internal-elb"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSIamCreateServiceLinkedRole",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:AWSServiceName": "eks.amazonaws.com"
}
}
},
{
"Sid": "EBEKSIamPermissionsImageBuild",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:PassedToService": [
"codebuild.amazonaws.com",
"eks.amazonaws.com",
"ec2.amazonaws.com",
"pods.eks.amazonaws.com",
"elasticbeanstalk.amazonaws.com"
]
}
}
},
{
"Sid": "EBEKSS3Permissions",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:GetObjectVersion",
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject",
"s3:PutObjectAcl"
],
"Resource": [
"arn:aws:s3:::elasticbeanstalk-*",
"arn:aws:s3:::elasticbeanstalk-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSEKSClusterManagement",
"Effect": "Allow",
"Action": [
"eks:CreateCluster",
"eks:DeleteCluster",
"eks:DescribeCluster",
"eks:DescribeUpdate",
"eks:CreateAccessEntry",
"eks:DeleteAccessEntry",
"eks:CreateAddon",
"eks:CreatePodIdentityAssociation",
"eks:ListPodIdentityAssociations"
],
"Resource": "arn:aws:eks:*:*:cluster/beanstalk-cluster*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSEKSAddonManagement",
"Effect": "Allow",
"Action": [
"eks:DeleteAddon",
"eks:DescribeAddon",
"eks:UpdateAddon"
],
"Resource": "arn:aws:eks:*:*:addon/beanstalk-cluster*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSEKSAccessEntryManagement",
"Effect": "Allow",
"Action": [
"eks:AssociateAccessPolicy",
"eks:DescribeAccessEntry",
"eks:ListAssociatedAccessPolicies"
],
"Resource": "arn:aws:eks:*:*:access-entry/beanstalk-cluster*/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSEKSPodIdentityManagement",
"Effect": "Allow",
"Action": [
"eks:DeletePodIdentityAssociation",
"eks:DescribePodIdentityAssociation",
"eks:UpdatePodIdentityAssociation"
],
"Resource": "arn:aws:eks:*:*:podidentityassociation/beanstalk-cluster*/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSCodeBuildProjectManagement",
"Effect": "Allow",
"Action": [
"codebuild:CreateProject",
"codebuild:UpdateProject",
"codebuild:StartBuild",
"codebuild:BatchGetBuilds",
"codebuild:BatchGetProjects"
],
"Resource": "arn:aws:codebuild:*:*:project/elasticbeanstalk-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSECRRepositoryManagement",
"Effect": "Allow",
"Action": [
"ecr:CreateRepository",
"ecr:DescribeRepositories",
"ecr:DescribeImages",
"ecr:PutLifecyclePolicy",
"ecr:TagResource"
],
"Resource": "arn:aws:ecr:*:*:repository/elasticbeanstalk-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSCFNStackManagementImageBuild",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/elasticbeanstalk-*-image-build",
"arn:aws:cloudformation:*:*:stack/elasticbeanstalk-*-image-build/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSCFNStackManagementClusterSetup",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStacks",
"cloudformation:ListStacks",
"cloudformation:UpdateStack"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/beanstalk-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSAPSCreateWorkspace",
"Effect": "Allow",
"Action": [
"aps:CreateWorkspace",
"aps:TagResource"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "ElasticBeanstalk",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSAPSManageWorkspace",
"Effect": "Allow",
"Action": [
"aps:DeleteWorkspace",
"aps:Describe*"
],
"Resource": "arn:aws:aps:*:*:workspace/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "ElasticBeanstalk"
}
}
},
{
"Sid": "EBEKSAPSRemoteWrite",
"Effect": "Allow",
"Action": [
"aps:RemoteWrite"
],
"Resource": "arn:aws:aps:*:*:workspace/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "ElasticBeanstalk"
}
}
},
{
"Sid": "EBEKSCreateDashboard",
"Effect": "Allow",
"Action": "cloudwatch:PutDashboard",
"Resource": "arn:aws:cloudwatch::*:dashboard/ElasticBeanstalk-Observability-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbLoadBalancerWrite",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:SetSecurityGroups",
"elasticloadbalancing:AddTags"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbTargetGroupCreate",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:AddTags"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
"Condition": {
"Null": {
"aws:RequestTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbTargetGroupModifyDelete",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:AddTags"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbListenerRuleCreate",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateRule",
"elasticloadbalancing:AddTags"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
],
"Condition": {
"Null": {
"aws:RequestTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbListenerRuleDelete",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DeleteRule"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbEC2CreateSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"Null": {
"aws:RequestTag/elasticbeanstalk:byo-alb-arn": "false",
"aws:RequestTag/elasticbeanstalk:managed": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbEC2CreateSecurityGroupVpc",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "arn:aws:ec2:*:*:vpc/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EBEKSByoAlbEC2CreateTags",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"Null": {
"aws:RequestTag/elasticbeanstalk:byo-alb-arn": "false",
"aws:RequestTag/elasticbeanstalk:managed": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": "CreateSecurityGroup"
}
}
},
{
"Sid": "EBEKSByoAlbEC2SecurityGroupEgress",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:byo-alb-arn": "false",
"aws:ResourceTag/elasticbeanstalk:managed": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ECRTagMutation",
"Effect": "Allow",
"Action": [
"ecr:TagResource",
"ecr:UntagResource"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:application-name": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CodeBuildTagMutation",
"Effect": "Allow",
"Action": "codebuild:UpdateProject",
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:application-name": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "TagMutation",
"Effect": "Allow",
"Action": [
"acm:AddTagsToCertificate",
"acm:RemoveTagsFromCertificate",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags",
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/elasticbeanstalk:environment-id": "false"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v8",
"IsDefaultVersion": true,
"CreateDate": "2026-08-18T17:17:24+00:00"
}
}Version History (12 recorded)
Raw historyv8updated
1 action added
v7updated
83 actions added
1 never-before-seen action: eks:DeleteCluster
3 permissions management, incl. iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole, iam:PassRole, s3:PutObjectAcl
AWSElasticBeanstalkServiceRolePolicy - Policy Version v6
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
f76e325Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2019
49aa1d0Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2019
71619cfUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2019
8279033`2019-08-29`
No recorded action delta - this version predates the change index. View the raw diff.
Aug 29, 2019
5016d52I updated my CLI and it looks like it reordered everything and changed the white-space, so everything looks changed, but is not
No recorded action delta - this version predates the change index. View the raw diff.
Jul 12, 2019
9d2dff1Update
No recorded action delta - this version predates the change index. View the raw diff.
Jun 7, 2019
8432a39First commit
No recorded action delta - this version predates the change index. View the raw diff.
Feb 10, 2019
ad4c2e8