title: How to fix "You do not have permission to perform the 'ec2:DescribeSubnets' action" with AWSElasticBeanstalkFullAccess Policy
body: <p>Whenever I run <code>aws elasticbeanstalk update-environment ...</code> the CLI returns success, but the Elastic Beanstalk dashboard shows error messages around <code>You do not have permission to perform the 'ec2:DescribeSubnets' action</code>.</p>
  
  <p>I have created an Elastic Beanstalk instance, and given it a service role "Beanstalk-Dev-ServiceRole".  That role has three policies attached to it:</p>
  
  <ul>
  <li>arn:aws:iam::aws:policy/AWSElasticBeanstalkFullAccess</li>
  <li>arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth</li>
  <li>arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkService</li>
  </ul>
  
  <p>(I've also tried just with AWSElasticBeanstalkFullAccess)</p>
  
  <p>I've uploaded a zip package to S3 with the intended environment version (beanstalk-dev-server-2019-07-30--05-52-49), and verified it is there.</p>
  
  <p>When I run <code>aws elasticbeanstalk update-environment --environment-name Beanstalk-Dev-Server --version-label beanstalk-dev-server-2019-07-30--05-52-49</code> the CLI reports success.  However when I look at the Beanstalk dashboard, all I see are two error messages:</p>
  
  <ul>
  <li>ERROR    Failed to deploy application.</li>
  <li>ERROR    Service:AmazonEC2, Message:You do not have permission to perform the 'ec2:DescribeSubnets' action.</li>
  </ul>
  
  <p>I've seen various posts that say the DescribeSubnets action is part of the AWSElasticBeanstalkFullAccess policy.  It doesn't look like it is anymore, but the AWSElasticBeanstalkService has ec2:* so it should be covered there.  For kicks I've also tried adding a custom policy that explicitly allows ec2:DescribeSubnets to resource *, but all of my attempts keep coming back with that same error message.</p>
  
  <p>Expecting the environment version to be updated with version specified in the CLI command, or at least an actionable error message.  Currently seeing an error message that I can't find any real actions on via search engines or docs.</p>