AWS emr documentation change

Service: emr · 2025-08-25 · Documentation low

File: emr/latest/EMR-on-EKS-DevelopmentGuide/security_iam_fgac-logging-kms.md

Summary

Updated KMS key ARNs and viaService conditions to use wildcards. Restructured policy statements.

Security assessment

Wildcards in viaService conditions enable multi-region compatibility, improving security documentation for KMS best practices.

Diff

diff --git a/emr/latest/EMR-on-EKS-DevelopmentGuide/security_iam_fgac-logging-kms.md b/emr/latest/EMR-on-EKS-DevelopmentGuide/security_iam_fgac-logging-kms.md
index f8257bb09..ec4331938 100644
--- a//emr/latest/EMR-on-EKS-DevelopmentGuide/security_iam_fgac-logging-kms.md
+++ b//emr/latest/EMR-on-EKS-DevelopmentGuide/security_iam_fgac-logging-kms.md
@@ -59 +59 @@ JSON
-            "KMS key ARN"
+            "arn:aws:kms:*:*:key/key-id"
@@ -84,3 +83,0 @@ JSON
-          "Principal": {
-            "AWS": "IAM role ARN used to call StartJobRun"
-          },
@@ -95 +92 @@ JSON
-              "kms:viaService": "emr-containers.us-east-1.amazonaws.com"
+              "kms:viaService": "emr-containers.*.amazonaws.com"
@@ -102,3 +98,0 @@ JSON
-          "Principal": {
-            "AWS": "IAM role ARN used to call StartJobRun"
-          },
@@ -114 +108 @@ JSON
-              "kms:viaService": "emr-containers.us-east-1.amazonaws.com",
+              "kms:viaService": "emr-containers.*.amazonaws.com",
@@ -118 +112 @@ JSON
-          "Sid": "AllowKMSDecrypt"
+          "Sid": "AllowKMSDecryptGenerate"
@@ -122,6 +115,0 @@ JSON
-          "Principal": {
-            "Service": [
-              "persistentappui.elasticmapreduce.amazonaws.com",
-              "elasticmapreduce.amazonaws.com"
-            ]
-          },
@@ -137,2 +125,4 @@ JSON
-              "kms:EncryptionContext:aws:emr-containers:virtualClusterId": "virtual cluster id",
-              "aws:SourceArn": "virtual cluster ARN"
+              "kms:EncryptionContext:aws:emr-containers:virtualClusterId": "virtual cluster id"
+            },
+            "ArnLike": {
+              "aws:SourceArn": "arn:aws:emr-containers:*:*:/virtualclusters/virtual_cluster_id"
@@ -141 +131 @@ JSON
-          "Sid": "AllowKMSDecrypt"
+          "Sid": "AllowKMSDecryptService"