AWS emr medium security documentation change

Service: emr · 2025-08-16 · Security-related medium

File: emr/latest/ManagementGuide/emr-iam-role.md

Summary

Updated IAM policies with array formatting, added explicit account IDs in AssumeRole conditions, and improved resource ARN specificity

Security assessment

The change to hardcode '111122223333' in aws:SourceAccount and aws:SourceArn conditions enforces account-specific restrictions, reducing potential cross-account access risks. This implements security best practices for role assumption policies.

Diff

diff --git a/emr/latest/ManagementGuide/emr-iam-role.md b/emr/latest/ManagementGuide/emr-iam-role.md
index dc6920e1e..bfc8b2047 100644
--- a//emr/latest/ManagementGuide/emr-iam-role.md
+++ b//emr/latest/ManagementGuide/emr-iam-role.md
@@ -62 +62,3 @@ JSON
-    			"Resource": "arn:aws:ec2:*:*:launch-template/*",
+          "Resource": [
+            "arn:aws:ec2:*:*:launch-template/*"
+          ],
@@ -72,2 +74,6 @@ JSON
-    			"Action": "ec2:CreateLaunchTemplate",
-    			"Resource": "arn:aws:ec2:*:*:launch-template/*",
+          "Action": [
+            "ec2:CreateLaunchTemplate"
+          ],
+          "Resource": [
+            "arn:aws:ec2:*:*:launch-template/*"
+          ],
@@ -127 +133,3 @@ JSON
-    			"Resource": "*",
+          "Resource": [
+            "*"
+          ],
@@ -225 +233,3 @@ JSON
-    			"Resource": "*"
+          "Resource": [
+            "*"
+          ]
@@ -263 +273,3 @@ JSON
-    			"Resource": "arn:aws:ec2:*:*:security-group/*",
+          "Resource": [
+            "arn:aws:ec2:*:*:security-group/*"
+          ],
@@ -280 +292,3 @@ JSON
-    			"Resource": "*",
+          "Resource": [
+            "*"
+          ],
@@ -293 +307,3 @@ JSON
-    			"Resource": "arn:aws:ec2:*:*:placement-group/pg-*"
+          "Resource": [
+            "arn:aws:ec2:*:*:placement-group/pg-*"
+          ]
@@ -301 +317,3 @@ JSON
-    			"Resource": "*"
+          "Resource": [
+            "*"
+          ]
@@ -314 +332,3 @@ JSON
-    			"Resource": "*"
+          "Resource": [
+            "*"
+          ]
@@ -322 +342,3 @@ JSON
-    			"Resource": "*"
+          "Resource": [
+            "*"
+          ]
@@ -332 +354,3 @@ JSON
-    			"Resource": "arn:aws:cloudwatch:*:*:alarm:*_EMR_Auto_Scaling"
+          "Resource": [
+            "arn:aws:cloudwatch:*:*:alarm:*_EMR_Auto_Scaling"
+          ]
@@ -337,2 +361,6 @@ JSON
-    			"Action": "iam:PassRole",
-    			"Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole",
+          "Action": [
+            "iam:PassRole"
+          ],
+          "Resource": [
+            "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole"
+          ],
@@ -348,2 +376,6 @@ JSON
-    			"Action": "iam:PassRole",
-    			"Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole",
+          "Action": [
+            "iam:PassRole"
+          ],
+          "Resource": [
+            "arn:aws:iam::*:role/EMR_EC2_DefaultRole"
+          ],
@@ -397 +429,3 @@ JSON
-                            "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*",
+          "Resource": [
+            "arn:aws:ec2:*:*:vpc-endpoint/*"
+          ],
@@ -427 +461 @@ JSON
-                "Sid": "",
+          "Sid": "AllowSTSAssumerole",
@@ -432 +466,3 @@ JSON
-                "Action": "sts:AssumeRole",
+          "Action": [
+            "sts:AssumeRole"
+          ],
@@ -435 +471 @@ JSON
-                        "aws:SourceAccount": "<account-id>"
+              "aws:SourceAccount": "111122223333"
@@ -438 +474 @@ JSON
-                        "aws:SourceArn": "arn:aws:elasticmapreduce:<region>:<account-id>:*"
+              "aws:SourceArn": "arn:aws:elasticmapreduce:region>:111122223333:*"