Question: My app currently uses a folder called "Documents" that is located in the root of the app. This is where it stores supporting docs, temporary files, uploaded files etc. I'm trying to move my app from Azure to Beanstalk and I don't know how to give permissions to this folder and sub-folders. I think it's supposed to be done using .ebextensions but I don't know how to format the config file. Can someone suggest how this config file should look? This is an ASP.NET app running on Windows/IIS.

Answer: 
Unfortunately, you cannot use .ebextensions to set permissions to files/folders within your deployment directory.

If you look at the event hooks for an elastic beanstalk deployment:
<https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-windows-ec2.html#windows-container-commands>

You'll find that `commands` run **before** the ec2 app and web server are set up, and
`container_commands` run **after** the ec2 app and web server are setup, but **before** your application version is deployed.

The solution is to use a **wpp.targets** file to set the necessary ACLs.
The following SO post is most useful
[Can Web Deploy's setAcl provider be used on a sub-directory?](https://stackoverflow.com/questions/6861990/can-web-deploys-setacl-provider-be-used-on-a-sub-directory)
See [this answer](https://serverfault.com/questions/842231/is-there-a-supported-way-to-run-post-deploy-scripts-on-aws-elastic-beanstalk/970974#970974?newreg=81d7b6290f6c4cae83b1672b20ab4ac2) on Serverfault.

There are [platform hooks](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/custom-platform-hooks.html) that you can use to run scripts at various points during deployment that can get you around the shortcomings of the .ebextension Commands and Platform Commands that Napoli describes.

There seems to be some debate on whether or not this setup is officially supported, but judging by comments made on the [AWS github](https://github.com/aws/elastic-beanstalk-roadmap/issues?q=is%3Aissue+hooks+), it seems to be not explicitly prohibited.

I can see where Napoli's answer could be the more standard MS way of doing things, but wpp.targets looks like hot trash IMO.

The general scheme of that answer is to use Commands/Platform commands to copy a script file into the appropriate platform hook directory (/opt/elasticbeanstalk/hooks or C:\Program Files\Amazon\ElasticBeanstalk\hooks\ ) to run at your desired stage of deployment.

I think its worth noting that differences exist between platforms and versions such as Amazon Linux 1 and Linux 2.

I hope this helps someone. It took me a day to gather that info and what's on this page and pick what I liked best.

Edit 11/4 - I would like to note that I saw some inconsistencies with the File .ebextension directive when trying to place scripts drirectly into the platform hook dir's during repeated deployments. Specifically the File directive failed to correctly move the backup copies named .bak/.bak1/etc. I would suggest using a Container Command to copy with overwriting from another directory into the desired hook directory to overcome this issue.