AWS emr medium security documentation change

Service: emr · 2025-08-25 · Security-related medium

File: emr/latest/ManagementGuide/emr-studio-user-permissions.md

Summary

Updated policy version to 2012-10-17, removed redundant permissions, and standardized ARNs

Security assessment

Policy version update to 2012-10-17 (supports newer security features) and removal of overly permissive s3:GetBucketLocation actions improve security posture.

Diff

diff --git a/emr/latest/ManagementGuide/emr-studio-user-permissions.md b/emr/latest/ManagementGuide/emr-studio-user-permissions.md
index 1a668e0a7..cf7e7df08 100644
--- a//emr/latest/ManagementGuide/emr-studio-user-permissions.md
+++ b//emr/latest/ManagementGuide/emr-studio-user-permissions.md
@@ -32 +32 @@ JSON
-      "Version": "2008-10-17",
+      "Version": "2012-10-17",
@@ -36,3 +35,0 @@ JSON
-          "Principal": {
-            "Service": "elasticmapreduce.amazonaws.com"
-          },
@@ -42,0 +40 @@ JSON
+          "Resource": "arn:aws:iam::123456789012:role/EMRStudioServiceRole",
@@ -450 +448 @@ JSON
-            "arn:aws:emr-containers:us-west-1:111122223333:/virtualclusters/virtual-cluster-id/endpoints/managed-endpoint-id"
+            "arn:aws:emr-containers:us-west-1:123456789012:/virtualclusters/virtual-cluster-id/endpoints/managed-endpoint-id"
@@ -455 +453 @@ JSON
-                "arn:aws:iam::111122223333:role/emr-on-eks-execution-role"
+                "arn:aws:iam::123456789012:role/emr-on-eks-execution-role"
@@ -520 +518 @@ JSON
-            "arn:aws:iam::*:role/your-emr-studio-service-role>"
+            "arn:aws:iam::*:role/your-emr-studio-service-role"
@@ -542 +540 @@ JSON
-            "arn:aws:s3:::aws-logs-aws-111122223333>-region>/elasticmapreduce/*"
+            "arn:aws:s3:::aws-logs-123456789012-us-east-1/elasticmapreduce/*"
@@ -695 +693 @@ JSON
-            "arn:aws:emr-containers:region:111122223333:/virtualclusters/virtual-cluster-id/endpoints/managed-endpoint-id"
+            "arn:aws:emr-containers:*:123456789012:/virtualclusters/virtual-cluster-id/endpoints/managed-endpoint-id"
@@ -700 +698 @@ JSON
-                "arn:aws:iam::111122223333:role/emr-on-eks-execution-role"
+                "arn:aws:iam::123456789012:role/emr-on-eks-execution-role"
@@ -775 +773 @@ JSON
-            "arn:aws:iam::*:role/your-emr-studio-service-role>",
+            "arn:aws:iam::*:role/your-emr-studio-service-role",
@@ -799 +797 @@ JSON
-            "arn:aws:s3:::aws-logs-aws-111122223333>-region>/elasticmapreduce/*"
+            "arn:aws:s3:::aws-logs-123456789012-us-east-1/elasticmapreduce/*"
@@ -946,2 +943,0 @@ JSON
-            "s3:GetBucketLocation",
-            "s3:GetBucketLocation",