AWS CLI command 'aws elasticbeanstalk describe-configuration-settings' asks for 's3:CreateBucket' permissions

Question

I need a tool to execute request "aws elasticbeanstalk describe-configuration-settings"
I granted least-privileged permissions via IAM role:
```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"elasticbeanstalk:DescribeEnvironments",
				"elasticbeanstalk:DescribeConfigurationSettings",
				"elasticbeanstalk:ListTagsForResource"
			],
			"Resource": "*"
		}
	]
}
```
But when executing this command I receive an error:

```
An error occurred (InsufficientPrivilegesException) when calling the DescribeConfigurationSettings operation: User: ... is not authorized to perform: s3:CreateBucket on resource: "arn:aws:s3:::elasticbeanstalk-us-east-1-YYYY" because no identity-based policy allows the s3:CreateBucket action
```
With some trial and error I managed to make this error go away with the next policy:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "elasticbeanstalk:DescribeEnvironments",
                "elasticbeanstalk:DescribeConfigurationSettings",
                "s3:GetBucketLocation",
                "elasticbeanstalk:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}
```
But then I got errors with missing access to `ec2:DescribeSubnets` and `ec2:DescribeImages`.

Finally, this command worked with the policy:
```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetObject",
				"s3:ListAllMyBuckets",
				"elasticbeanstalk:DescribeEnvironments",
				"elasticbeanstalk:DescribeConfigurationSettings",
				"s3:GetBucketLocation",
				"elasticbeanstalk:ListTagsForResource",
				"ec2:DescribeSubnets",
				"ec2:DescribeImages"
			],
			"Resource": "*"
		}
	]
}
```
Why do I need to grant access to all of these permissions only to run the  "aws elasticbeanstalk describe-configuration-settings" command?

re:Post Agent · Answer

The `aws elasticbeanstalk describe-configuration-settings` command requires additional permissions beyond just the Elastic Beanstalk action itself because it needs to retrieve and display comprehensive configuration information about your environment.

When you execute this command, Elastic Beanstalk needs to:

1. Access S3 buckets where Elastic Beanstalk stores configuration data (`s3:GetObject`, `s3:ListAllMyBuckets`, `s3:GetBucketLocation`)

2. Retrieve information about EC2 resources that are part of your environment configuration (`ec2:DescribeSubnets`, `ec2:DescribeImages`)

3. Perform the core Elastic Beanstalk operations (`elasticbeanstalk:DescribeEnvironments`, `elasticbeanstalk:DescribeConfigurationSettings`, `elasticbeanstalk:ListTagsForResource`)

The error message about `s3:CreateBucket` is somewhat misleading, as the command doesn't actually need to create buckets. This appears to be a case where the service is checking for permissions it might need during the operation, even if those permissions aren't always used. The actual minimum set of permissions needed are those in your final working policy.

To follow the principle of least privilege while ensuring the command works properly, you should use a policy similar to your final working example, which includes permissions for the specific AWS services that Elastic Beanstalk interacts with to retrieve the complete configuration settings.  
**Sources**  
[Resources and conditions for Elastic Beanstalk actions - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html)  
[How do I troubleshoot when User: arn is no authorized to perform Create * or Delete * or Update * on resource(s) because no identity- policy allows the actions | AWS re:Post](https://repost.aws/articles/ARKj9INM-NSmasOMsjm4BWUA/how-do-i-troubleshoot-when-user-arn-is-no-authorized-to-perform-create-or-delete-or-update-on-resource-s-because-no-identity-policy-allows-the-actions)  
[Security configurations and IAM roles - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/dotnet-migrating-applications-security.html)

Joel Maglinti Reas · Answer

1.Access S3 Bucket
            s3:joelreas.administrator-website-sources.us-west-1-us-west-2.aws.amazon
2.Retrieve Information 
              ec2:aws.ManagementConsole.Administrator
3.Perform the Core Elastic Beanstalk Operation   
              Benefits Agentic AI Tutorials

AWS CLI command 'aws elasticbeanstalk describe-configuration-settings' asks for 's3:CreateBucket' permissions

Add your answer

Relevant content