How To Set Folder Permissions in Elastic Beanstalk

Question

I have a C# Web API Elastic Beanstalk app which needs a folder outside the deployment directory that the IUSER and IIS_USERS users can write to. I've created a .config file and put this in the top level .ebextensions folder in my project. The contents are below:

commands:
  0_mkdir:
    command: mkdir C:\\AppFolder\\

  1_set_iuser_permissions:
    command: cacls C:\\AppFolder\\ /t /e /g IUser:f IIS_Users:f

However while the folder is created successfully the permissions aren't set. If anyone has any idea what I am doing wrong I would be hugely grateful. Big thanks in advance.

Answer 1

It looks like you are using invalid .net accounts (unless these are custom accounts you created). That is part of the reason why your permissions are not being set. They should be IUSR or IIS_IUSRS

Furthermore, container_commands executes after your app/server environment has been setup, but before your deployment has started. There is no other way to set permissions on files/folders within your deployment directory other than using a wpp.targets file within visual studio.

The following SO post is a good read using wpp.targets to solve your issue. Can Web Deploy's setAcl provider be used on a sub-directory?

Answer 2

Place a file 01_fix_permissions.config inside .ebextensions folder.

contents:

files:
  "/opt/elasticbeanstalk/hooks/appdeploy/pre/49_change_permissions.sh":
    mode: "000755"
    owner: root
    group: root
    content: |
      #!/usr/bin/env bash
      sudo chown -R ec2-user:ec2-user tmp/

Answer 3

In the end I switched to using Json instead of YAML as, despite my YAML being validated by several online YAML testers, AWS still wouldn't accept it. It always had issues with the parameters passed to icacls. I also changed to a folder within the application App_Data folder as setting permissions on any directory external to the application didn't appear to work. So, my final configuration file is as follows:

{
    "container_commands": {
        "01": {
            "command": "icacls \"C:/inetpub/wwwroot/AppName_deploy/App_Data/AppFolder\" /grant DefaultAppPool:(OI)(CI)F"
        }
    }
}

Hope this helps someone else out.