AWS emr documentation change

Service: emr · 2025-08-13 · Documentation low

File: emr/latest/ManagementGuide/using-service-linked-roles-cleanup.md

Summary

Added explicit IAM policy example for creating service-linked role with condition

Security assessment

The change provides concrete IAM policy documentation for service-linked role creation but does not address a specific security vulnerability. It improves clarity around required permissions without evidence of fixing an exploit.

Diff

diff --git a/emr/latest/ManagementGuide/using-service-linked-roles-cleanup.md b/emr/latest/ManagementGuide/using-service-linked-roles-cleanup.md
index 3c1ad3a0a..e5f0c394e 100644
--- a//emr/latest/ManagementGuide/using-service-linked-roles-cleanup.md
+++ b//emr/latest/ManagementGuide/using-service-linked-roles-cleanup.md
@@ -67 +67,13 @@ You must configure permissions to allow an IAM entity (such as a user, group, or
-You don't need to manually create the AWSServiceRoleForEMRCleanup role. When you launch a cluster, either for the first time or when the AWSServiceRoleForEMRCleanup service-linked role is not present, Amazon EMR creates the AWSServiceRoleForEMRCleanup service-linked role for you. You must have permissions to create a service-linked role. For an example statement that adds this capability to the permissions policy of an IAM entity (such as a user, group, or role), see [Using service-linked roles for Amazon EMR for cleanup](./using-service-linked-roles-cleanup.html).
+You don't need to manually create the AWSServiceRoleForEMRCleanup role. When you launch a cluster, either for the first time or when the AWSServiceRoleForEMRCleanup service-linked role is not present, Amazon EMR creates the AWSServiceRoleForEMRCleanup service-linked role for you. You must have permissions to create a service-linked role. For an example statement that adds this capability to the permissions policy of an IAM entity (such as a user, group, or role): 
+
+Add the following statement to the permissions policy for the IAM entity that needs to create the service-linked role.
+    
+    
+    {
+       "Effect": "Allow",
+       "Action": [
+           "iam:CreateServiceLinkedRole"
+       ],
+       "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*",
+       "Condition": {"StringLike": {"iam:AWSServiceName": "ops.emr-serverless.amazonaws.com"}}
+     }