Minimum Elastic Beanstalk policy for upload & deploy

I just created a new Elastic Beanstalk application called Chats.

I then created a IAM group called Chats.

Now, I want to give the Chats group a custom policy that is the most restrictive and only allows users in the Chats group to upload & deploy new Chats application versions.