AWS emr medium security documentation change

Service: emr · 2025-07-04 · Security-related medium

File: emr/latest/ManagementGuide/app-history-spark-UI.md

Summary

Updated IAM policy examples to enforce runtime role-based access restrictions and added policy for viewing all applications in runtime role clusters

Security assessment

The changes enforce least-privilege access by restricting Spark UI access to applications submitted with the same runtime role. The `AccessAllEventLogs` action addition explicitly addresses access control for audit logs, which is a security concern.

Diff

diff --git a/emr/latest/ManagementGuide/app-history-spark-UI.md b/emr/latest/ManagementGuide/app-history-spark-UI.md
index 858af5d4d..8fdc3ce1c 100644
--- a//emr/latest/ManagementGuide/app-history-spark-UI.md
+++ b//emr/latest/ManagementGuide/app-history-spark-UI.md
@@ -101 +101 @@ Note that compaction attempts to exclude events with outdated event log files, s
-The following sample shows the role permissions required for access to persistent application user interfaces.
+The following sample shows the role permissions required for access to persistent application user interfaces. For clusters with runtime role enabled, this will only allow users to access applications submitted by the same user identity and runtime role.
@@ -136,0 +137,37 @@ The following sample shows the role permissions required for access to persisten
+The following sample shows the role permissions required for removing the restrictions on viewing applications in the persistent application user interfaces for runtime role enabled clusters.
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            { 
+                "Effect": "Allow", 
+                "Action": [ 
+                    "elasticmapreduce:CreatePersistentAppUI",
+                    "elasticmapreduce:DescribePersistentAppUI",
+                    "elasticmapreduce:AccessAllEventLogs"
+                ], 
+                "Resource": [ 
+                    "arn:aws:elasticmapreduce:region:accountId:cluster/clusterId" 
+                ] 
+            },
+            { 
+                "Effect": "Allow", 
+                "Action": [ 
+                    "elasticmapreduce:GetPersistentAppUIPresignedURL" 
+                ],
+                "Resource": [ 
+                    "arn:aws:elasticmapreduce:region:accountId:cluster/clusterId", 
+                    "arn:aws:elasticmapreduce:region:accountId:persistent-app-ui/*" 
+                ],
+                "Condition": { 
+                    "StringEqualsIfExists": { 
+                        "elasticmapreduce:ExecutionRoleArn": [ 
+                            "executionRoleArn" 
+                        ] 
+                    } 
+                }
+            }
+        ]
+    }
+
@@ -152,0 +190,2 @@ One-click access to persistent application user interfaces currently has the fol
+  * The `AccessAllEventLogs` action for Amazon EMR is necessary to view all applications in persistent application user interfaces for runtime role enabled clusters. 
+