AWS emr medium security documentation change

Service: emr · 2025-08-16 · Security-related medium

File: emr/latest/EMR-on-EKS-DevelopmentGuide/jobruns-flink-kubernetes-operator-setup.md

Summary

Updated OIDC provider ARN format and service account reference in IAM role trust policy

Security assessment

Corrected OIDC provider ARN format and tightened subject condition to prevent potential misconfiguration that could allow unauthorized role assumption. The change from placeholder 'OIDC_PROVIDER' to concrete 'oidc.eks.us-east-1.amazonaws.com/id/EXAMPLE123ABC456' ensures proper web identity federation configuration.

Diff

diff --git a/emr/latest/EMR-on-EKS-DevelopmentGuide/jobruns-flink-kubernetes-operator-setup.md b/emr/latest/EMR-on-EKS-DevelopmentGuide/jobruns-flink-kubernetes-operator-setup.md
index cbbbc4c6a..efc27de84 100644
--- a//emr/latest/EMR-on-EKS-DevelopmentGuide/jobruns-flink-kubernetes-operator-setup.md
+++ b//emr/latest/EMR-on-EKS-DevelopmentGuide/jobruns-flink-kubernetes-operator-setup.md
@@ -41 +41 @@ JSON
-                    "Federated": "arn:aws:iam::111122223333:oidc-provider/OIDC_PROVIDER"
+            "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLE123ABC456"
@@ -43 +43,6 @@ JSON
-                "Action": "sts:AssumeRoleWithWebIdentity",
+          "Action": [
+            "sts:AssumeRoleWithWebIdentity"
+          ],
+          "Resource": [
+            "*"
+          ],
@@ -46,2 +51 @@ JSON
-                        "OIDC_PROVIDER:sub": "system:serviceaccount:NAMESPACE:emr-containers-sa-flink-operator"
-                    }
+              "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLE123ABC456:sub": "system:serviceaccount:emr:emr-containers-sa-flink-operator"
@@ -48,0 +53,2 @@ JSON
+          },
+          "Sid": "AllowSTSAssumerolewithwebidentity"