Reference IAM policy for Elastic Beanstalk ... see http://rossfairbanks.com/2013/10/13/iam-permissions-for-elastic-beanstalk.html

eb-iam-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "iam:ListInstanceProfiles"
      ],
      "Sid": "Stmt1381157441000",
      "Resource": [
        "arn:aws:iam::123456789012:instance-profile/"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:CreateRole"
      ],
      "Sid": "Stmt1381157476000",
      "Resource": [
        "arn:aws:iam::123456789012:role/aws-elasticbeanstalk-ec2-role"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:CreateInstanceProfile"
      ],
      "Sid": "Stmt1381157517000",
      "Resource": [
        "arn:aws:iam::123456789012:instance-profile/aws-elasticbeanstalk-ec2-role"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:AddRoleToInstanceProfile"
      ],
      "Sid": "Stmt1381157545000",
      "Resource": [
        "arn:aws:iam::123456789012:instance-profile/aws-elasticbeanstalk-ec2-role"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:CreateGroup"
      ],
      "Sid": "Stmt1381157568000",
      "Resource": [
        "arn:aws:iam::123456789012:group/AWSEBRDSDBSecurityGroup"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "iam:PassRole"
      ],
      "Sid": "Stmt1381158023000",
      "Resource": [
        "arn:aws:iam::123456789012:role/aws-elasticbeanstalk-ec2-role"
      ],
      "Effect": "Allow"
    }
  ]