title: Elastic Beanstalk deployment stuck on updating config settings
body: <p>I've been testing my continuous deployment setup, trying to get to a minimal set of IAM permissions that will allow my CI IAM group to deploy to my "staging" Elastic Beanstalk environment.</p>
  
  <p>On my latest test, my deployment got stuck. The last event in the console is:</p>
  
  <pre><code>Updating environment staging's configuration settings.
  </code></pre>
  
  <p>Luckily, the deployment will time out after 30 minutes, so the environment can be deployed to again.</p>
  
  <p>It seems to be a permissions issue, because if I grant <code>s3:*</code> on all resources, the deployment works. It seems that when calling <a href="http://docs.aws.amazon.com/elasticbeanstalk/latest/APIReference/API_UpdateEnvironment.html" rel="nofollow">UpdateEnvironment</a>, Elastic Beanstalk does something to S3, but I can't figure out what.</p>
  
  <p>I have tried the following policy to give EB full access to its resource bucket:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Resource": [
                  "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/_runtime/_embedded_extensions/APP",
                  "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/_runtime/_embedded_extensions/APP/*",
                  "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/environments/ENV_ID",
                  "arn:aws:s3:::elasticbeanstalk-REGION-ACCOUNT/resources/environments/ENV_ID/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Where <code>REGION</code>, <code>ACCOUNT</code>, <code>APP</code>, and <code>ENV_ID</code> are my AWS region, account number, application name, and environment ID, respectively.</p>
  
  <p>Does anyone have a clue which S3 action and resource EB is trying to access?</p>