AWS emr medium security documentation change

Service: emr · 2025-08-16 · Security-related medium

File: emr/latest/ManagementGuide/emr-managed-policy-fullaccess-v2.md

Summary

Improved IAM policy formatting and added explicit resource restrictions for PassRole actions

Security assessment

Explicitly specifying ARNs for iam:PassRole actions (e.g., EMR_EC2_DefaultRole) enforces least-privilege access, reducing potential privilege escalation risks through role passing.

Diff

diff --git a/emr/latest/ManagementGuide/emr-managed-policy-fullaccess-v2.md b/emr/latest/ManagementGuide/emr-managed-policy-fullaccess-v2.md
index 3797644e8..ef182616e 100644
--- a//emr/latest/ManagementGuide/emr-managed-policy-fullaccess-v2.md
+++ b//emr/latest/ManagementGuide/emr-managed-policy-fullaccess-v2.md
@@ -46 +46,3 @@ JSON
-                "Resource": "*",
+          "Resource": [
+            "*"
+          ],
@@ -103 +105,3 @@ JSON
-                "Resource": "*"
+          "Resource": [
+            "*"
+          ]
@@ -111 +115,3 @@ JSON
-                "Resource": "*"
+          "Resource": [
+            "*"
+          ]
@@ -116 +122,3 @@ JSON
-                "Action": "iam:PassRole",
+          "Action": [
+            "iam:PassRole"
+          ],
@@ -130,2 +138,6 @@ JSON
-                "Action": "iam:PassRole",
-                "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole",
+          "Action": [
+            "iam:PassRole"
+          ],
+          "Resource": [
+            "arn:aws:iam::*:role/EMR_EC2_DefaultRole"
+          ],
@@ -141,2 +153,6 @@ JSON
-                "Action": "iam:PassRole",
-                "Resource": "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole",
+          "Action": [
+            "iam:PassRole"
+          ],
+          "Resource": [
+            "arn:aws:iam::*:role/EMR_AutoScaling_DefaultRole"
+          ],
@@ -152,2 +168,6 @@ JSON
-                "Action": "iam:CreateServiceLinkedRole",
-                "Resource": "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*",
+          "Action": [
+            "iam:CreateServiceLinkedRole"
+          ],
+          "Resource": [
+            "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com*/AWSServiceRoleForEMRCleanup*"
+          ],
@@ -180 +200,3 @@ JSON
-                "Resource": "*"
+          "Resource": [
+            "*"
+          ]