How to give particular/full access to Elastic beanstalk using aws CDK? - amazon-web-services

Question

I have created aws pipeline to deploy my dot net framework app to elastic beanstalk using CDK typescript code.
But in deploy step it fails with below error
Insufficient permissions
The provided role does not have the elasticbeanstalk:CreateApplicationVersion permission
I am not sure how to assign permissions using aws cdk.
How should I add permissions in below code
Below is my deploy stage code
const appName = "SampleDotNetMVCWebApp";
const newRole = new iam.Role(this, "Role", {
assumedBy: new iam.ServicePrincipal("elasticbeanstalk.amazonaws.com")
});
newRole.addToPolicy(
new iam.PolicyStatement({
resources: ["*"],
actions: ["elasticbeanstalk:CreateApplicationVersion"]
})
);
const app = new elasticbeanstalk.CfnApplication(this, "EBApplication", {
applicationName: appName
});
const elbEnv = new elasticbeanstalk.CfnEnvironment(this, "Environment", {
environmentName: "SampleMVCEBEnvironment",
applicationName: appName,
platformArn: platform,
solutionStackName: "64bit Windows Server 2012 R2 v2.5.0 running IIS 8.5"
});
pipeline.addStage({
stageName: "Deploy",
actions: [
new ElasticBeanStalkDeployAction({
actionName: "DeployToEB",
applicationName: appName,
environmentName: "SampleMVCEBEnvironment",
input: cdkBuildOutput,
role: newRole
})
]
});
NOTE: In above code aws pipeline action "ElasticBeanStalkDeployAction" is custom action as aws cdk has not release this deploy to eb action feature yet.
You can check the issue and code for implementation of IAction here
https://github.com/aws/aws-cdk/issues/2516

Answer 1

You need to add permissions to ElasticBeanStalkDeployAction to create CreateApplicationVersion, Use .addToPolicy
These policies will be created with the role, whereas those added by
addToPolicy are added using a separate CloudFormation resource
(allowing a way around circular dependencies that could otherwise be
introduced).
const elasticBeanStalkDeployAction = new ElasticBeanStalkDeployAction({
actionName: 'DeployToEB',
applicationName: appName,
environmentName: 'SampleMVCEBEnvironment',
input: cdkBuildOutput
})
elasticBeanStalkDeployAction.addToRolePolicy(new PolicyStatement({
effect: Effect.ALLOW,
resources: ['*'],
actions: ['elasticbeanstalk:*']
}));
Later, use the object you created and pass it into the action:
pipeline.addStage({
stageName: 'Deploy',
actions: [elasticBeanStalkDeployAction]
});

Answer 2

Alternatively as suggested here - https://github.com/aws/aws-cdk/issues/2516
This issue can be resolved by adding policy in bind method of ElasticBeanStalkDeployAction
public bind(scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
options.role.addManagedPolicy(
iam.ManagedPolicy.fromAwsManagedPolicyName(
"AWSElasticBeanstalkFullAccess"
));
}