title: Enabling Managed Updates for Elastic Beanstalk with terraform
body: <p>I am trying to enable managed updates with terraform but i am getting the following error</p>
  <pre><code>Error: ConfigurationValidationException: Configuration validation exception: Invalid option specification (Namespace: 'aws:elasticbeanstalk:managedactions', OptionName: 'ManagedActionsEnabled'): You can't enable managed platform updates when your environment uses the service-linked role 'AWSServiceRoleForElasticBeanstalk'. Select a service role that has the 'AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy' managed policy.
  </code></pre>
  <p>Terraform code:</p>
  <pre><code>resource &quot;aws_elastic_beanstalk_environment&quot; &quot;eb_env&quot; {
  
    setting {
       namespace = &quot;aws:elasticbeanstalk:managedactions&quot;
       name      = &quot;ManagedActionsEnabled&quot;
       value     = &quot;True&quot;
    }
  
    setting {
       namespace = &quot;aws:elasticbeanstalk:managedactions&quot;
       name      = &quot;ServiceRoleForManagedUpdates&quot;
       value     = aws_iam_role.beanstalk_service.arn
    }
  
    setting {
       namespace = &quot;aws:elasticbeanstalk:managedactions&quot;
       name      = &quot;PreferredStartTime&quot;
       value     = &quot;Sat:04:00&quot;
    }
  
    setting {
       namespace = &quot;aws:elasticbeanstalk:managedactions:platformupdate&quot;
       name      = &quot;UpdateLevel&quot;
       value     = &quot;patch&quot;
    }
    
  
  }
  
  
  resource &quot;aws_iam_instance_profile&quot; &quot;beanstalk_service&quot; {
      name = &quot;beanstalk-service-user&quot;
      role = &quot;${aws_iam_role.beanstalk_service.name}&quot;
  }
  
  resource &quot;aws_iam_instance_profile&quot; &quot;beanstalk_ec2&quot; {
      name = &quot;beanstalk-ec2-user&quot;
      role = &quot;${aws_iam_role.beanstalk_ec2.name}&quot;
  }
  
  resource &quot;aws_iam_role&quot; &quot;beanstalk_service&quot; {
      name = &quot;beanstalk-service&quot;
      assume_role_policy = &lt;&lt;EOF
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;elasticbeanstalk.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Condition&quot;: {
          &quot;StringEquals&quot;: {
            &quot;sts:ExternalId&quot;: &quot;elasticbeanstalk&quot;
          }
        }
      }
    ]
  }
  EOF
  }
  
  resource &quot;aws_iam_role&quot; &quot;beanstalk_ec2&quot; {
      name = &quot;aws-elasticbeanstalk-ec2-role&quot;
      assume_role_policy = &lt;&lt;EOF
  {
    &quot;Version&quot;: &quot;2008-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  EOF
  }
  
  resource &quot;aws_iam_policy_attachment&quot; &quot;beanstalk_service_health&quot; {
      name = &quot;elastic-beanstalk-service-health&quot;
      roles = [&quot;${aws_iam_role.beanstalk_service.id}&quot;]
      policy_arn = &quot;arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth&quot;
  }
  
  resource &quot;aws_iam_policy_attachment&quot; &quot;beanstalk_ec2_worker&quot; {
      name = &quot;elastic-beanstalk-ec2-worker&quot;
      roles = [&quot;${aws_iam_role.beanstalk_ec2.id}&quot;]
      policy_arn = &quot;arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier&quot;
  }
  
  resource &quot;aws_iam_service_linked_role&quot; &quot;managedupdates_eb&quot; {
    aws_service_name = &quot;managedupdates.elasticbeanstalk.amazonaws.com&quot;
  }
  
  resource &quot;aws_iam_policy_attachment&quot; &quot;beanstalk_ec2_web&quot; {
      name = &quot;elastic-beanstalk-ec2-web&quot;
      roles = [&quot;${aws_iam_role.beanstalk_ec2.id}&quot;]
      policy_arn = &quot;arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier&quot;
  }
  
  resource &quot;aws_iam_policy_attachment&quot; &quot;beanstalk_ec2_container&quot; {
      name = &quot;elastic-beanstalk-ec2-container&quot;
      roles = [&quot;${aws_iam_role.beanstalk_ec2.id}&quot;]
      policy_arn = &quot;arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker&quot;
  }
  
  resource &quot;aws_iam_policy_attachment&quot; &quot;beanstalk_service&quot; {
      name = &quot;elastic-beanstalk-service&quot;
      roles = [&quot;${aws_iam_role.beanstalk_service.id}&quot;]
      policy_arn = &quot;arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy&quot;
  }
  </code></pre>
  <p>I did attempt to create a linked service role but that is not the solution for the error above.</p>
  <pre><code>setting {
       namespace = &quot;aws:elasticbeanstalk:managedactions&quot;
       name      = &quot;ServiceRoleForManagedUpdates&quot;
       value     = aws_iam_service_linked_role.managedupdates_eb.arn
    }
  </code></pre>