AWS emr documentation change
Summary
Minor wording improvements and documentation link phrasing changes (e.g., 'see' to 'refer to'), terminology update from 'Tez application master' to 'Tez application primary', and grammatical simplifications in cross-account access instructions
Security assessment
Changes are primarily stylistic/grammatical improvements rather than substantive security content updates. The terminology change from 'master' to 'primary' appears to be an inclusive language update. No new security controls, vulnerabilities, or mitigations are introduced.
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/jobs-s3-access.md b/emr/latest/EMR-Serverless-UserGuide/jobs-s3-access.md index 072bb8348..0666d1529 100644 --- a//emr/latest/EMR-Serverless-UserGuide/jobs-s3-access.md +++ b//emr/latest/EMR-Serverless-UserGuide/jobs-s3-access.md @@ -15 +15 @@ Jobs that run on EMR Serverless can use an S3 bucket policy or an assumed role t -To set up cross-account access for Amazon EMR Serverless, you must complete tasks while signed in to two AWS accounts: +To set up cross-account access for Amazon EMR Serverless, complete tasks while signed in to two AWS accounts: @@ -17 +17 @@ To set up cross-account access for Amazon EMR Serverless, you must complete task - * `AccountA` – This is the AWS account where you have created an Amazon EMR Serverless application. Before you set up cross-account access, you must have the following ready in this account: + * `AccountA` – This is the AWS account where you have created an Amazon EMR Serverless application. Before you set up cross-account access, have the following ready in this account: @@ -21 +21 @@ To set up cross-account access for Amazon EMR Serverless, you must complete task - * A job execution role that has the required permissions to run jobs in the application. For more information, see [Job runtime roles for Amazon EMR Serverless](./security-iam-runtime-role.html). + * A job execution role that has the required permissions to run jobs in the application. For more information, refer to [Job runtime roles for Amazon EMR Serverless](./security-iam-runtime-role.html). @@ -68 +68 @@ JSON -For more information about S3 cross-account access with S3 bucket policies, see [Example 2: Bucket owner granting cross-account bucket permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example2.html) in the _Amazon Simple Storage Service User Guide_. +For more information about S3 cross-account access with S3 bucket policies, refer to [Example 2: Bucket owner granting cross-account bucket permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example2.html) in the _Amazon Simple Storage Service User Guide_. @@ -76 +76 @@ The following steps illustrate how to use an assumed role to access cross-accoun - 1. Create an Amazon S3 bucket, `cross-account-bucket`, in `AccountB`. For more information, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/gsg/CreatingABucket.html) in the _Amazon Simple Storage Service User Guide_. If you want to have cross-account access to DynamoDB, you can also create a DynamoDB table in `AccountB`. For more information, see [Creating a DynamoDB table](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/getting-started-step-1.html) in the _Amazon DynamoDB Developer Guide_. + 1. Create an Amazon S3 bucket, `cross-account-bucket`, in `AccountB`. For more information, refer to [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/gsg/CreatingABucket.html) in the _Amazon Simple Storage Service User Guide_. If you want to have cross-account access to DynamoDB, also create a DynamoDB table in `AccountB`. For more information, refer to [Creating a DynamoDB table](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/getting-started-step-1.html) in the _Amazon DynamoDB Developer Guide_. @@ -82 +82 @@ The following steps illustrate how to use an assumed role to access cross-accoun - 2. Choose **Roles** and create a new role: `Cross-Account-Role-B`. For more information about how to create IAM roles, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the IAM User Guide. + 2. Choose **Roles** and create a new role: `Cross-Account-Role-B`. For more information about how to create IAM roles, refer to [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the IAM User Guide. @@ -84 +84 @@ The following steps illustrate how to use an assumed role to access cross-accoun - 3. Create an IAM policy that specifies the permissions for `Cross-Account-Role-B` to access the `cross-account-bucket` S3 bucket, as the following policy statement demonstrates. Then attach the IAM policy to `Cross-Account-Role-B`. For more information, see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the _IAM User Guide_. + 3. Create an IAM policy that specifies the permissions for `Cross-Account-Role-B` to access the `cross-account-bucket` S3 bucket, as the following policy statement demonstrates. Then attach the IAM policy to `Cross-Account-Role-B`. For more information, refer to [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the _IAM User Guide_. @@ -110 +110 @@ JSON -If you require DynamoDB access, create an IAM policy that specifies permissions to access the cross-account DynamoDB table. Then attach the IAM policy to `Cross-Account-Role-B`. For more information, see [Amazon DynamoDB: Allows access to a specific table](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_specific-table.html) in the _IAM User Guide_. +If you require DynamoDB access, create an IAM policy that specifies permissions to access the cross-account DynamoDB table. Then attach the IAM policy to `Cross-Account-Role-B`. For more information, refer to [Amazon DynamoDB: Allows access to a specific table](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_specific-table.html) in the _IAM User Guide_. @@ -200 +200 @@ JSON -You can use a single assumed role to access all S3 resources in an account, or with Amazon EMR 6.11 and higher, you can configure multiple IAM roles to assume when you access different cross-account S3 buckets. +Use a single assumed role to access all S3 resources in an account, or with Amazon EMR 6.11 and higher, configure multiple IAM roles to assume when you access different cross-account S3 buckets. @@ -223 +223 @@ If you want to use a single assumed role to access all S3 resources in account B - 3. For Hive, use `hive.emr-serverless.launch.env.ASSUME_ROLE_CREDENTIALS_ROLE_ARN`, `tez.am.emr-serverless.launch.env.ASSUME_ROLE_CREDENTIALS_ROLE_ARN`, and `tez.task.emr-serverless.launch.env.ASSUME_ROLE_CREDENTIALS_ROLE_ARN` to specify the environment variables on Hive driver, Tez application master, and Tez task containers. + 3. For Hive, use `hive.emr-serverless.launch.env.ASSUME_ROLE_CREDENTIALS_ROLE_ARN`, `tez.am.emr-serverless.launch.env.ASSUME_ROLE_CREDENTIALS_ROLE_ARN`, and `tez.task.emr-serverless.launch.env.ASSUME_ROLE_CREDENTIALS_ROLE_ARN` to specify the environment variables on Hive driver, Tez application primary, and Tez task containers. @@ -228 +228 @@ If you want to use a single assumed role to access all S3 resources in account B -The following examples show how to use an assumed role to start an EMR Serverless job run with cross-account access. +The following examples demonstrate how to use an assumed role to start an EMR Serverless job run with cross-account access. @@ -286 +286 @@ The following example shows how to use an assumed role to start an EMR Serverles -With EMR Serverless releases 6.11.0 and higher, you can configure multiple IAM roles to assume when you access different cross-account buckets. If you want to access different S3 resources with different assumed roles in account B, use following configurations when you start the job run: +With EMR Serverless releases 6.11.0 and higher, configure multiple IAM roles to assume when you access different cross-account buckets. If you want to access different S3 resources with different assumed roles in account B, use following configurations when you start the job run: @@ -295 +295 @@ With EMR Serverless releases 6.11.0 and higher, you can configure multiple IAM r -For example, you can use `arn:aws:iam::`AccountB`:role/Cross-Account-Role-B-1` to access bucket `bucket1`, and use `arn:aws:iam::`AccountB`:role/Cross-Account-Role-B-2` to access bucket `bucket2`. The following examples show how to start an EMR Serverless job run with cross-account access through multiple assumed roles. +For example, use `arn:aws:iam::`AccountB`:role/Cross-Account-Role-B-1` to access bucket `bucket1`, and use `arn:aws:iam::`AccountB`:role/Cross-Account-Role-B-2` to access bucket `bucket2`. The following examples demonstrate how to start an EMR Serverless job run with cross-account access through multiple assumed roles. @@ -326 +326 @@ Hive -The following examples show how to use multiple assumed roles to create an EMR Serverless Hive job run. +The following examples demonstrate how to use multiple assumed roles to create an EMR Serverless Hive job run.