AWS emr documentation change
Summary
Updated IAM policy examples with proper JSON formatting (array syntax for Actions/Resources), placeholder replacements with example values, and added missing Sid identifier
Security assessment
Changes improve policy documentation clarity but don't address specific vulnerabilities. Security-related because it documents IAM permissions, but no evidence of fixing an existing security issue. Formatting changes prevent potential misconfiguration risks.
Diff
diff --git a/emr/latest/ManagementGuide/emr-studio-user-permissions.md b/emr/latest/ManagementGuide/emr-studio-user-permissions.md index e7096cc82..1a668e0a7 100644 --- a//emr/latest/ManagementGuide/emr-studio-user-permissions.md +++ b//emr/latest/ManagementGuide/emr-studio-user-permissions.md @@ -42 +42,2 @@ JSON - ] + ], + "Sid": "AllowSTSAssumerole" @@ -255 +256,3 @@ JSON - "Resource":"arn:aws:ec2:*:*:security-group/*", + "Resource": [ + "arn:aws:ec2:*:*:security-group/*" + ], @@ -268 +271,3 @@ JSON - "Resource":"*", + "Resource": [ + "*" + ], @@ -274,2 +279,6 @@ JSON - "Action":"secretsmanager:CreateSecret", - "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*", + "Action": [ + "secretsmanager:CreateSecret" + ], + "Resource": [ + "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + ], @@ -285,2 +294,6 @@ JSON - "Action":"secretsmanager:TagResource", - "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*" + "Action": [ + "secretsmanager:TagResource" + ], + "Resource": [ + "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + ] @@ -290 +303,3 @@ JSON - "Action":"iam:PassRole", + "Action": [ + "iam:PassRole" + ], @@ -292 +307 @@ JSON - "arn:aws:iam::*:role/<your-emr-studio-service-role>" + "arn:aws:iam::*:role/your-emr-studio-service-role>" @@ -303 +318,3 @@ JSON - "Resource":"arn:aws:s3:::*", + "Resource": [ + "arn:aws:s3:::*" + ], @@ -312 +329 @@ JSON - "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*" + "arn:aws:s3:::aws-logs-aws-111122223333>-region>/elasticmapreduce/*" @@ -324 +341,3 @@ JSON - "Resource":"*", + "Resource": [ + "*" + ], @@ -340 +359,3 @@ JSON - "Resource":"*" + "Resource": [ + "*" + ] @@ -348 +369,3 @@ JSON - "Resource":"*" + "Resource": [ + "*" + ] @@ -400 +423,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -413 +438,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -423 +450 @@ JSON - "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>" + "arn:aws:emr-containers:us-west-1:111122223333:/virtualclusters/virtual-cluster-id/endpoints/managed-endpoint-id" @@ -428 +455 @@ JSON - "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>" + "arn:aws:iam::111122223333:role/emr-on-eks-execution-role" @@ -438 +465,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -444,2 +473,6 @@ JSON - "Action": "secretsmanager:CreateSecret", - "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*", + "Action": [ + "secretsmanager:CreateSecret" + ], + "Resource": [ + "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + ], @@ -455,2 +488,6 @@ JSON - "Action": "secretsmanager:TagResource", - "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + "Action": [ + "secretsmanager:TagResource" + ], + "Resource": [ + "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + ] @@ -472 +509,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -477 +516,3 @@ JSON - "Action": "iam:PassRole", + "Action": [ + "iam:PassRole" + ], @@ -479 +520 @@ JSON - "arn:aws:iam::*:role/<your-emr-studio-service-role>" + "arn:aws:iam::*:role/your-emr-studio-service-role>" @@ -490 +531,3 @@ JSON - "Resource": "arn:aws:s3:::*", + "Resource": [ + "arn:aws:s3:::*" + ], @@ -499 +542 @@ JSON - "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*" + "arn:aws:s3:::aws-logs-aws-111122223333>-region>/elasticmapreduce/*" @@ -511 +554,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -527 +572,3 @@ JSON - "Resource": "*" + "Resource": [ + "*" + ] @@ -535 +582,3 @@ JSON - "Resource": "*" + "Resource": [ + "*" + ] @@ -554 +603,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -559,2 +610,6 @@ JSON - "Action": "iam:PassRole", - "Resource": "arn:aws:iam::*:role/serverless-runtime-role", + "Action": [ + "iam:PassRole" + ], + "Resource": [ + "arn:aws:iam::*:role/serverless-runtime-role" + ], @@ -613 +668,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -626 +683,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -636 +695 @@ JSON - "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>" + "arn:aws:emr-containers:region:111122223333:/virtualclusters/virtual-cluster-id/endpoints/managed-endpoint-id" @@ -641 +700 @@ JSON - "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>" + "arn:aws:iam::111122223333:role/emr-on-eks-execution-role" @@ -651 +710,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ], @@ -657,2 +718,6 @@ JSON - "Action": "secretsmanager:CreateSecret", - "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*", + "Action": [ + "secretsmanager:CreateSecret" + ], + "Resource": [ + "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + ], @@ -668,2 +733,6 @@ JSON - "Action": "secretsmanager:TagResource", - "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + "Action": [ + "secretsmanager:TagResource" + ], + "Resource": [ + "arn:aws:secretsmanager:*:*:secret:emr-studio-*" + ] @@ -685 +754,3 @@ JSON - "Resource": "*", + "Resource": [ + "*" + ],