AWS emr documentation change

Service: emr · 2025-08-16 · Documentation low

File: emr/latest/ManagementGuide/emr-studio-admin-permissions.md

Summary

Updated IAM policy examples with concrete ARN formats, added Sid identifiers, and corrected resource formatting

Security assessment

Changes improve policy documentation clarity but don't address specific vulnerabilities. The updates demonstrate security best practices through explicit resource ARNs and policy statement IDs (Sids), which help with auditability but don't indicate a security fix.

Diff

diff --git a/emr/latest/ManagementGuide/emr-studio-admin-permissions.md b/emr/latest/ManagementGuide/emr-studio-admin-permissions.md
index 197d965bc..8b2dceb0a 100644
--- a//emr/latest/ManagementGuide/emr-studio-admin-permissions.md
+++ b//emr/latest/ManagementGuide/emr-studio-admin-permissions.md
@@ -146 +146,3 @@ JSON
-                "Resource": "arn:aws:elasticmapreduce:<region>:<aws-account-id>:studio/*",
+          "Resource": [
+            "arn:aws:elasticmapreduce:region>:aws-111122223333>:studio/*"
+          ],
@@ -151 +153,2 @@ JSON
-                ]
+          ],
+          "Sid": "AllowELASTICMAPREDUCECreatestudio"
@@ -155 +158,3 @@ JSON
-                "Resource": "<your-resource-ARN>",
+          "Resource": [
+            "your-resource-ARN>"
+          ],
@@ -158 +163,2 @@ JSON
-                ]
+          ],
+          "Sid": "AllowELASTICMAPREDUCEListstudios"
@@ -163 +169,4 @@ JSON
-                    "arn:aws:iam::<aws-account-id>:role/<EMR-Service-Role>"
+            "arn:aws:iam::aws-111122223333>:role/amzn-s3-demo-bucket"
+          ],
+          "Action": [
+            "iam:PassRole"
@@ -165 +174 @@ JSON
-                "Action": "iam:PassRole"
+          "Sid": "AllowIAMPassrole"
@@ -188 +197,3 @@ JSON
-                "Resource": "arn:aws:elasticmapreduce:<region>:<aws-account-id>:studio/*",
+          "Resource": [
+            "arn:aws:elasticmapreduce:region>:aws-111122223333>:studio/*"
+          ],
@@ -197 +208,2 @@ JSON
-                ]
+          ],
+          "Sid": "AllowELASTICMAPREDUCECreatestudio"
@@ -201 +213,3 @@ JSON
-                "Resource": "<your-resource-ARN>",
+          "Resource": [
+            "your-resource-ARN>"
+          ],
@@ -205 +219,2 @@ JSON
-                ]
+          ],
+          "Sid": "AllowELASTICMAPREDUCEListstudios"
@@ -210,2 +225,2 @@ JSON
-                    "arn:aws:iam::<aws-account-id>:role/<EMRStudio-Service-Role>",
-                    "arn:aws:iam::<aws-account-id>:role/<EMRStudio-User-Role>"
+            "arn:aws:iam::aws-111122223333>:role/EMRStudio-SvcRole",
+            "arn:aws:iam::aws-111122223333>:role/EMRStudio-User-Role>"
@@ -213 +228,4 @@ JSON
-                "Action": "iam:PassRole"
+          "Action": [
+            "iam:PassRole"
+          ],
+          "Sid": "AllowIAMPassrole"
@@ -217 +235,3 @@ JSON
-                "Resource": "*",
+          "Resource": [
+            "*"
+          ],
@@ -249 +269,2 @@ JSON
-                ]
+          ],
+          "Sid": "AllowSSOCreateapplication"