AWS emr medium security documentation change
Summary
Updated resource ARNs, added Sids, and corrected condition key from emr:ResourceTag to elasticmapreduce:ResourceTag
Security assessment
The correction from 'emr:ResourceTag' to 'elasticmapreduce:ResourceTag' fixes a potential misconfiguration in tag-based access control. This could prevent unintended access if users relied on the incorrect condition key, making it a security-relevant documentation fix.
Diff
diff --git a/emr/latest/ManagementGuide/emr-studio-manage-users.md b/emr/latest/ManagementGuide/emr-studio-manage-users.md index 6b9ccb18b..11a3cb152 100644 --- a//emr/latest/ManagementGuide/emr-studio-manage-users.md +++ b//emr/latest/ManagementGuide/emr-studio-manage-users.md @@ -51 +51,3 @@ JSON - "Resource": "arn:aws:elasticmapreduce:<region>:<account-id>:studio/<studio-id>" + "Resource": [ + "arn:aws:elasticmapreduce:us-east-1:111122223333:studio/studio-id>" + ] @@ -86 +88,3 @@ JSON - "Resource": "arn:aws:elasticmapreduce:<region>:<account-id>:studio/*", + "Resource": [ + "arn:aws:elasticmapreduce:region>:111122223333>:studio/*" + ], @@ -121,2 +125,6 @@ JSON - "Action": "elasticmapreduce:CreateStudioPresignedUrl", - "Resource": "<example-studio-arn>", + "Action": [ + "elasticmapreduce:CreateStudioPresignedUrl" + ], + "Resource": [ + "arn:aws:elasticmapreduce:us-east-1:111122223333:studio/studio-name" + ], @@ -125,2 +133 @@ JSON - "aws:SourceIdentity": "<example-source-identity>" - } + "aws:SourceIdentity": "example-source-identity>" @@ -127,0 +135,2 @@ JSON + }, + "Sid": "AllowELASTICMAPREDUCECreatestudiopresignedurl" @@ -272 +281,3 @@ JSON - "Resource": "arn:aws:elasticmapreduce:<region>:<account-id>:studio/*", + "Resource": [ + "arn:aws:elasticmapreduce:us-east-1:111122223333:studio/*" + ], @@ -275 +286 @@ JSON - "emr:ResourceTag/Team": [ + "elasticmapreduce:ResourceTag/Team": [