AWS Elastic BeanstalkAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

# Placeholders: replace the account, VPC, subnets, bucket and certificate with your own. Run it from the folder that holds the app.
REGION=ap-south-1
ACCOUNT=111122223333
BUCKET=orders-eb-versions-example
RECEIPTS=orders-receipts-example
VPC=vpc-0123456789abcdef0
PRIVATE_SUBNETS=subnet-0aaa1111bbbb2222c,subnet-0ddd3333eeee4444f
PUBLIC_SUBNETS=subnet-0eee5555ffff6666a,subnet-0999aaaabbbbcccc1
CERT_ARN=arn:aws:acm:$REGION:$ACCOUNT:certificate/00000000-0000-0000-0000-000000000000

# 1. Roles. The service role lets Beanstalk manage health and updates. The instance profile is what the app itself may do.
aws iam create-role --role-name eb-orders-service --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow", "Principal": {"Service": "elasticbeanstalk.amazonaws.com"}, "Action": "sts:AssumeRole"}]}'
for P in service-role/AWSElasticBeanstalkEnhancedHealth service-role/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy; do
  aws iam attach-role-policy --role-name eb-orders-service --policy-arn arn:aws:iam::aws:policy/$P
done

aws iam create-role --role-name eb-orders-instance --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow", "Principal": {"Service": "ec2.amazonaws.com"}, "Action": "sts:AssumeRole"}]}'
aws iam attach-role-policy --role-name eb-orders-instance --policy-arn arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
aws iam put-role-policy --role-name eb-orders-instance --policy-name receipts-write --policy-document '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::'$RECEIPTS'/receipts/*"}]}'
aws iam create-instance-profile --instance-profile-name eb-orders-instance
aws iam add-role-to-instance-profile --instance-profile-name eb-orders-instance --role-name eb-orders-instance

# 2. The bundle: a Procfile tells the platform how to start the app.
echo 'web: gunicorn --bind :8000 --workers 3 app:app' > Procfile
zip -r orders-1.4.2.zip . -x '*.git*' '*.pyc' '__pycache__/*'
aws s3 cp orders-1.4.2.zip s3://$BUCKET/orders-api/orders-1.4.2.zip

# 3. Look up a current Amazon Linux 2023 Python platform instead of copying an old name.
STACK=$(aws elasticbeanstalk list-available-solution-stacks --region $REGION \
  --query "SolutionStacks[?contains(@, 'Amazon Linux 2023') && contains(@, 'Python')] | [0]" --output text)
echo "platform: $STACK"

aws elasticbeanstalk create-application --region $REGION --application-name orders-api
aws elasticbeanstalk create-application-version --region $REGION --application-name orders-api --version-label 1.4.2 \
  --source-bundle S3Bucket=$BUCKET,S3Key=orders-api/orders-1.4.2.zip

# 4. The environment settings, as option settings.
cat > options.json <<EOF
[
  {"Namespace": "aws:autoscaling:launchconfiguration", "OptionName": "IamInstanceProfile", "Value": "eb-orders-instance"},
  {"Namespace": "aws:autoscaling:launchconfiguration", "OptionName": "InstanceType", "Value": "t3.small"},
  {"Namespace": "aws:autoscaling:asg", "OptionName": "MinSize", "Value": "2"},
  {"Namespace": "aws:autoscaling:asg", "OptionName": "MaxSize", "Value": "6"},
  {"Namespace": "aws:elasticbeanstalk:environment", "OptionName": "EnvironmentType", "Value": "LoadBalanced"},
  {"Namespace": "aws:elasticbeanstalk:environment", "OptionName": "LoadBalancerType", "Value": "application"},
  {"Namespace": "aws:elasticbeanstalk:environment", "OptionName": "ServiceRole", "Value": "eb-orders-service"},
  {"Namespace": "aws:elasticbeanstalk:command", "OptionName": "DeploymentPolicy", "Value": "Immutable"},
  {"Namespace": "aws:elasticbeanstalk:healthreporting:system", "OptionName": "SystemType", "Value": "enhanced"},
  {"Namespace": "aws:elasticbeanstalk:managedactions", "OptionName": "ManagedActionsEnabled", "Value": "true"},
  {"Namespace": "aws:elasticbeanstalk:managedactions", "OptionName": "PreferredStartTime", "Value": "Sun:21:00"},
  {"Namespace": "aws:elasticbeanstalk:managedactions:platformupdate", "OptionName": "UpdateLevel", "Value": "minor"},
  {"Namespace": "aws:elasticbeanstalk:application:environment", "OptionName": "RECEIPT_BUCKET", "Value": "$RECEIPTS"},
  {"Namespace": "aws:ec2:vpc", "OptionName": "VPCId", "Value": "$VPC"},
  {"Namespace": "aws:ec2:vpc", "OptionName": "Subnets", "Value": "$PRIVATE_SUBNETS"},
  {"Namespace": "aws:ec2:vpc", "OptionName": "ELBSubnets", "Value": "$PUBLIC_SUBNETS"},
  {"Namespace": "aws:ec2:vpc", "OptionName": "AssociatePublicIpAddress", "Value": "false"},
  {"Namespace": "aws:elbv2:listener:443", "OptionName": "Protocol", "Value": "HTTPS"},
  {"Namespace": "aws:elbv2:listener:443", "OptionName": "SSLCertificateArns", "Value": "$CERT_ARN"}
]
EOF
aws elasticbeanstalk create-environment --region $REGION --application-name orders-api --environment-name orders-prod \
  --solution-stack-name "$STACK" --version-label 1.4.2 --option-settings file://options.json
aws elasticbeanstalk wait environment-exists --region $REGION --application-name orders-api --environment-names orders-prod
aws elasticbeanstalk describe-environments --region $REGION --environment-names orders-prod \
  --query 'Environments[0].{status:Status,health:Health,url:CNAME}'

# 5. Ship the next version: upload it, then point the environment at it. The immutable policy starts a fresh set of instances first.
aws elasticbeanstalk create-application-version --region $REGION --application-name orders-api --version-label 1.5.0 \
  --source-bundle S3Bucket=$BUCKET,S3Key=orders-api/orders-1.5.0.zip
aws elasticbeanstalk update-environment --region $REGION --environment-name orders-prod --version-label 1.5.0
aws elasticbeanstalk wait environment-updated --region $REGION --application-name orders-api --environment-names orders-prod

# 6. Is a platform update waiting?
aws elasticbeanstalk describe-environment-managed-actions --region $REGION --environment-name orders-prod --query "ManagedActions[].{type:ActionType,status:Status,desc:ActionDescription}"

# Placeholders: pass in your own VPC, subnets, certificate and the platform name (find it with
# `aws elasticbeanstalk list-available-solution-stacks`).
variable "vpc_id" {
  type = string
}

variable "private_subnets" {
  type = list(string)
}

variable "public_subnets" {
  type = list(string)
}

variable "certificate_arn" {
  type = string
}

variable "solution_stack_name" {
  type = string
}

variable "receipt_bucket" {
  type    = string
  default = "orders-receipts-example"
}

data "aws_iam_policy_document" "eb_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["elasticbeanstalk.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ec2_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "service" {
  name               = "eb-orders-service"
  assume_role_policy = data.aws_iam_policy_document.eb_trust.json
}

resource "aws_iam_role_policy_attachment" "service" {
  for_each = toset([
    "service-role/AWSElasticBeanstalkEnhancedHealth",
    "service-role/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy",
  ])
  role       = aws_iam_role.service.name
  policy_arn = "arn:aws:iam::aws:policy/${each.key}"
}

resource "aws_iam_role" "instance" {
  name               = "eb-orders-instance"
  assume_role_policy = data.aws_iam_policy_document.ec2_trust.json
}

resource "aws_iam_role_policy_attachment" "web_tier" {
  role       = aws_iam_role.instance.name
  policy_arn = "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier"
}

resource "aws_iam_role_policy" "receipts" {
  name = "receipts-write"
  role = aws_iam_role.instance.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:PutObject"
      Resource = "arn:aws:s3:::${var.receipt_bucket}/receipts/*"
    }]
  })
}

resource "aws_iam_instance_profile" "instance" {
  name = "eb-orders-instance"
  role = aws_iam_role.instance.name
}

resource "aws_elastic_beanstalk_application" "orders" {
  name        = "orders-api"
  description = "Orders API"
}

resource "aws_elastic_beanstalk_environment" "prod" {
  name                = "orders-prod"
  application         = aws_elastic_beanstalk_application.orders.name
  solution_stack_name = var.solution_stack_name
  tier                = "WebServer"

  setting {
    namespace = "aws:autoscaling:launchconfiguration"
    name      = "IamInstanceProfile"
    value     = aws_iam_instance_profile.instance.name
  }
  setting {
    namespace = "aws:autoscaling:launchconfiguration"
    name      = "InstanceType"
    value     = "t3.small"
  }
  setting {
    namespace = "aws:autoscaling:asg"
    name      = "MinSize"
    value     = "2"
  }
  setting {
    namespace = "aws:autoscaling:asg"
    name      = "MaxSize"
    value     = "6"
  }
  setting {
    namespace = "aws:elasticbeanstalk:environment"
    name      = "EnvironmentType"
    value     = "LoadBalanced"
  }
  setting {
    namespace = "aws:elasticbeanstalk:environment"
    name      = "LoadBalancerType"
    value     = "application"
  }
  setting {
    namespace = "aws:elasticbeanstalk:environment"
    name      = "ServiceRole"
    value     = aws_iam_role.service.name
  }
  setting {
    namespace = "aws:elasticbeanstalk:command"
    name      = "DeploymentPolicy"
    value     = "Immutable"
  }
  setting {
    namespace = "aws:elasticbeanstalk:healthreporting:system"
    name      = "SystemType"
    value     = "enhanced"
  }
  setting {
    namespace = "aws:elasticbeanstalk:managedactions"
    name      = "ManagedActionsEnabled"
    value     = "true"
  }
  setting {
    namespace = "aws:elasticbeanstalk:managedactions"
    name      = "PreferredStartTime"
    value     = "Sun:21:00"
  }
  setting {
    namespace = "aws:elasticbeanstalk:managedactions:platformupdate"
    name      = "UpdateLevel"
    value     = "minor"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name      = "RECEIPT_BUCKET"
    value     = var.receipt_bucket
  }
  setting {
    namespace = "aws:ec2:vpc"
    name      = "VPCId"
    value     = var.vpc_id
  }
  setting {
    namespace = "aws:ec2:vpc"
    name      = "Subnets"
    value     = join(",", var.private_subnets)
  }
  setting {
    namespace = "aws:ec2:vpc"
    name      = "ELBSubnets"
    value     = join(",", var.public_subnets)
  }
  setting {
    namespace = "aws:ec2:vpc"
    name      = "AssociatePublicIpAddress"
    value     = "false"
  }
  setting {
    namespace = "aws:elbv2:listener:443"
    name      = "Protocol"
    value     = "HTTPS"
  }
  setting {
    namespace = "aws:elbv2:listener:443"
    name      = "SSLCertificateArns"
    value     = var.certificate_arn
  }

  depends_on = [aws_iam_role_policy_attachment.service, aws_iam_role_policy_attachment.web_tier]
}

output "environment_url" {
  value = aws_elastic_beanstalk_environment.prod.cname
}

# Deploys a version that is already in S3 and waits for the environment to settle. Usage: deploy.py <version-label>
import sys
import time

import boto3

eb = boto3.client("elasticbeanstalk")
APP, ENV = "orders-api", "orders-prod"
BUCKET = "orders-eb-versions-example"


def deploy(label):
    eb.create_application_version(
        ApplicationName=APP, VersionLabel=label,
        SourceBundle={"S3Bucket": BUCKET, "S3Key": "orders-api/orders-%s.zip" % label},
        Description="deployed by deploy.py")
    started = time.time()
    eb.update_environment(EnvironmentName=ENV, VersionLabel=label)

    eb.get_waiter("environment_updated").wait(ApplicationName=APP, EnvironmentNames=[ENV],
                                              WaiterConfig={"Delay": 15, "MaxAttempts": 80})
    env = eb.describe_environments(EnvironmentNames=[ENV])["Environments"][0]
    print("%s is %s, health %s, running %s" % (env["EnvironmentName"], env["Status"], env["Health"], env["VersionLabel"]))

    if env["Health"] != "Green" or env["VersionLabel"] != label:
        events = eb.describe_events(EnvironmentName=ENV, StartTime=time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(started)),
                                    Severity="WARN")["Events"]
        for e in events[:8]:
            print("  %s %s" % (e["Severity"], e["Message"]))
        sys.exit("deployment did not leave the environment green on %s" % label)


if __name__ == "__main__":
    deploy(sys.argv[1])

// dotnet add package AWSSDK.ElasticBeanstalk
// Lists every environment with its status, health and version, and the warnings and errors from the last day.
using Amazon.ElasticBeanstalk;
using Amazon.ElasticBeanstalk.Model;

using var eb = new AmazonElasticBeanstalkClient();
var envs = (await eb.DescribeEnvironmentsAsync(new DescribeEnvironmentsRequest { IncludeDeleted = false })).Environments;

int worrying = 0;
foreach (EnvironmentDescription env in envs.OrderBy(e => e.ApplicationName).ThenBy(e => e.EnvironmentName))
{
    bool ok = env.Health == EnvironmentHealth.Green;
    if (!ok) worrying++;
    Console.WriteLine($"{env.ApplicationName}/{env.EnvironmentName,-16} {env.Status,-10} {env.Health,-7} version={env.VersionLabel} platform={env.PlatformArn?.Split('/').Last()}");

    var events = (await eb.DescribeEventsAsync(new DescribeEventsRequest
    {
        EnvironmentName = env.EnvironmentName,
        StartTime = DateTime.UtcNow.AddDays(-1),
        Severity = EventSeverity.WARN,
        MaxRecords = 5
    })).Events;
    foreach (EventDescription e in events)
        Console.WriteLine($"    {e.Severity,-5} {e.EventDate:u}  {e.Message}");
}
Console.WriteLine(worrying == 0 ? $"{envs.Count} environment(s), all green." : $"{worrying} of {envs.Count} environment(s) need a look.");
return worrying == 0 ? 0 : 1;