# AdministratorAccess-AWSElasticBeanstalk AdministratorAccess-AWSElasticBeanstalk **Description**: Grants account administrative permissions. Explicitly allows developers and administrators to gain direct access to resources they need to manage AWS Elastic Beanstalk applications `AdministratorAccess-AWSElasticBeanstalk` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies). ## Using this policy You can attach `AdministratorAccess-AWSElasticBeanstalk` to your users, groups, and roles. ## Policy details + **Type**: AWS managed policy + **Creation time**: January 22, 2021, 19:36 UTC + **Edited time:** February 12, 2026, 18:00 UTC + **ARN**: `arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk` ## Policy version **Policy version:** v9 (default) The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request. ## JSON policy document ``` { "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : [ "acm:Describe*", "acm:List*", "autoscaling:Describe*", "cloudformation:Describe*", "cloudformation:Estimate*", "cloudformation:Get*", "cloudformation:List*", "cloudformation:Validate*", "cloudtrail:LookupEvents", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "codecommit:Get*", "codecommit:UploadArchive", "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroup*", "ec2:CreateLaunchTemplate*", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteLaunchTemplate*", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:Describe*", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroup*", "ecs:CreateCluster", "ecs:DeRegisterTaskDefinition", "ecs:Describe*", "ecs:List*", "ecs:RegisterTaskDefinition", "elasticbeanstalk:*", "elasticloadbalancing:Describe*", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "logs:Describe*", "rds:Describe*", "s3:ListAllMyBuckets", "sns:ListSubscriptionsByTopic", "sns:ListTopics", "sqs:ListQueues" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "autoscaling:*" ], "Resource" : [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Effect" : "Allow", "Action" : [ "cloudformation:CancelUpdateStack", "cloudformation:ContinueUpdateRollback", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplate", "cloudformation:ListStackResources", "cloudformation:SignalResource", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStack" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Effect" : "Allow", "Action" : [ "cloudwatch:DeleteAlarms", "cloudwatch:PutMetricAlarm" ], "Resource" : [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Effect" : "Allow", "Action" : [ "codebuild:BatchGetBuilds", "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:StartBuild" ], "Resource" : "arn:aws:codebuild:*:*:project/Elastic-Beanstalk-*" }, { "Effect" : "Allow", "Action" : [ "dynamodb:CreateTable", "dynamodb:DeleteTable", "dynamodb:DescribeTable", "dynamodb:TagResource" ], "Resource" : [ "arn:aws:dynamodb:*:*:table/awseb-e-*", "arn:aws:dynamodb:*:*:table/eb-*" ] }, { "Effect" : "Allow", "Action" : [ "ec2:RebootInstances", "ec2:TerminateInstances" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringLike" : { "ec2:ResourceTag/aws:cloudformation:stack-id" : [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Effect" : "Allow", "Action" : "ec2:RunInstances", "Resource" : "*", "Condition" : { "ArnLike" : { "ec2:LaunchTemplate" : "arn:aws:ec2:*:*:launch-template/*" } } }, { "Effect" : "Allow", "Action" : [ "ecs:DeleteCluster" ], "Resource" : "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Effect" : "Allow", "Action" : [ "elasticloadbalancing:*Rule", "elasticloadbalancing:*Tags", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetSecurityGroups" ], "Resource" : [ "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*", "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*/*" ] }, { "Effect" : "Allow", "Action" : [ "elasticloadbalancing:*" ], "Resource" : [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*", "arn:aws:elasticloadbalancing:*:*:listener/awseb-*", "arn:aws:elasticloadbalancing:*:*:listener/eb-*", "arn:aws:elasticloadbalancing:*:*:listener/*/awseb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener/*/eb-*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/awseb-*/*/*/*", "arn:aws:elasticloadbalancing:*:*:listener-rule/app/eb-*/*/*/*" ] }, { "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:CreateRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-elasticbeanstalk*", "arn:aws:iam::*:instance-profile/aws-elasticbeanstalk*" ] }, { "Effect" : "Allow", "Action" : [ "iam:AttachRolePolicy" ], "Resource" : "arn:aws:iam::*:role/aws-elasticbeanstalk*", "Condition" : { "ArnLike" : { "iam:PolicyArn" : [ "arn:aws:iam::aws:policy/AWSElasticBeanstalk*", "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalk*" ] } } }, { "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/*", "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.rproxy.govskope.ca.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*", "arn:aws:iam::*:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing*", "arn:aws:iam::*:role/aws-service-role/managedupdates.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*", "arn:aws:iam::*:role/aws-service-role/maintenance.elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk*" ], "Condition" : { "StringLike" : { "iam:AWSServiceName" : [ "autoscaling.amazonaws.com", "elasticbeanstalk.amazonaws.com", "elasticloadbalancing.amazonaws.com", "managedupdates.elasticbeanstalk.amazonaws.com", "maintenance.elasticbeanstalk.amazonaws.com" ] } } }, { "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource" : "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Effect" : "Allow", "Action" : [ "rds:*DBSubnetGroup", "rds:AuthorizeDBSecurityGroupIngress", "rds:CreateDBInstance", "rds:CreateDBSecurityGroup", "rds:DeleteDBInstance", "rds:DeleteDBSecurityGroup", "rds:ModifyDBInstance", "rds:RestoreDBInstanceFromDBSnapshot" ], "Resource" : [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:secgrp:awseb-e-*", "arn:aws:rds:*:*:secgrp:eb-*", "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:subgrp:awseb-e-*", "arn:aws:rds:*:*:subgrp:eb-*" ] }, { "Effect" : "Allow", "Action" : [ "s3:Delete*", "s3:Get*", "s3:Put*" ], "Resource" : "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:GetBucket*", "s3:ListBucket", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketOwnershipControls" ], "Resource" : "arn:aws:s3:::elasticbeanstalk-*" }, { "Effect" : "Allow", "Action" : [ "sns:CreateTopic", "sns:DeleteTopic", "sns:GetTopicAttributes", "sns:Publish", "sns:SetTopicAttributes", "sns:Subscribe", "sns:Unsubscribe" ], "Resource" : "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Effect" : "Allow", "Action" : [ "sqs:*QueueAttributes", "sqs:CreateQueue", "sqs:DeleteQueue", "sqs:SendMessage", "sqs:TagQueue" ], "Resource" : [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Effect" : "Allow", "Action" : [ "ecs:TagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "ecs:CreateAction" : [ "CreateCluster", "RegisterTaskDefinition" ] } } } ] } ``` ## Learn more + [Create a permission set using AWS managed policies in IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [Understand versioning for IAM policies](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)