What are appropriate S3 permissions for deploying to Elastic Beanstalk from CodeShip

Question

What are the appropriate S3 permissions to deploy an Elastic Beanstalk app using CodeShip? When deploying a new version to a tomcat app I get these errors:

Service:Amazon S3, Message:You do not have permission to perform the 's3:ListBucket' action. Verify that your S3 policies and your ACLs allow you to perform these actions.

Service:Amazon S3, Message:You do not have permission to perform the 's3:GetObject' or 's3:ListBucket' action. Verify that your S3 policies and your ACLs allow you to perform these actions.

If I give the CodeShip user full access to S3 everything works, but this is not ideal. The current S3 permissions for my CodeShip user are

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketPolicy"
            ],
            "Resource": [
                "arn:aws:s3:::codeshipbucket/*"
            ]
        }
    ]
}

My S3 bucket I have given CodeShip is a subfolder under codeshipbucket if it matters.

What are appropriate permissions?

Answer 1

These are the S3 permissions we had to give the IAM user we use with Codeship:

    {
        "Action": [
            "s3:CreateBucket",
            "s3:GetObject"
        ],
        "Effect": "Allow",
        "Resource": "*"
    },
    {
        "Action": [
            "s3:ListBucket",
            "s3:GetObjectAcl",
            "s3:GetBucketPolicy",
            "s3:DeleteObject",
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::elasticbeanstalk-[region]-[account-id]",
            "arn:aws:s3:::elasticbeanstalk-[region]-[account-id]/*"
        ]
    }

We executed eb deploy --debug and added the permissions one-by-one.