title: AWS Policy not respecting
body: <p>On ElasticBeanstalk, under Logs section, when I access this tab I immediately get an error, <code>An error occurred retrieving logs: Access Denied</code>.</p>
  
  <p>If I click on request latest 100 lines of log I get another error on EB events.</p>
  
  <p><code>Failed retrieveEnvironmentInfo activity. Reason: Access Denied</code></p>
  
  <p>On events log I get two errors:</p>
  
  <pre><code>ERROR   Failed retrieveEnvironmentInfo activity. Reason: Access Denied
  INFO    [Instance: i-0aa53b9c5f88fe09b] Successfully finished tailing 36 log(s)
  INFO    Pulled logs for environment instances.
  ERROR   Service:Amazon S3, Message:Access Denied
  </code></pre>
  
  <p>My role policy atm allow me for these operations:</p>
  
  <pre><code> "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "autoscaling:*",
                  "cloudformation:*",
                  "cloudwatch:*",
                  "dynamodb:*",
                  "ec2:Describe*",
                  "ec2:Get*",
                  "ec2messages:Get*",
                  "elasticbeanstalk:*",
                  "iam:*",
                  "kms:ListAliases",
                  "lambda:Get*",
                  "lambda:List*",
                  "logs:Describe*",
                  "logs:FilterLogEvents",
                  "logs:Get*",
                  "logs:List*",
                  "logs:ListTagsLogGroup",
                  "logs:TestMetricFilter",
                  "sdb:Get*",
                  "s3:Get*",
                  "s3:List*",
                  "ses:*",
                  "sns:*",
                  "sqs:*"
              ],
              "Resource": "*"
          },
          {
              "Effect": "Deny",
              "Action": [
                  "cloudformation:DeleteStack",
                  "dynamodb:DeleteTable",
                  "elasticbeanstalk:DeleteEnvironment*",
                  "elasticbeanstalk:DeleteApplication",
                  "iam:Create*",
                  "iam:Delete*",
                  "iam:Remove*",
                  "s3:DeleteBucket",
                  "sqs:DeleteQueue"
              ],
              "Resource": "*"
          }
  </code></pre>
  
  <p>I also have my EB policy.</p>
  
  <pre><code>        "autoscaling:Describe*",
          "autoscaling:SuspendProcesses",
          "autoscaling:ResumeProcesses",
          "cloudwatch:*",
          "cloudformation:List*",
          "cloudformation:Describe*",
          "cloudformation:Get*",
          "elasticbeanstalk:*",
          "elasticfilesystem:Describe*",
          "elasticloadbalancing:DescribeLoadBalancers",
          "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
          "health:Describe*",
          "health:Get*",
          "health:List*",
          "lambda:UpdateFunctionCode",
          "lambda:CreateAlias",
          "logs:*",
          "s3:Get*",
          "s3:List*",
          "s3:Head*",
          "s3:Put*",
          "s3:DeleteObject"
      ],
      "Effect": "Allow",
      "Resource": "*"
  </code></pre>
  
  <p>So, when you use ELB and try to see logs, does it use the user role policy or the service policy to check for permission? it seems pretty weird.</p>