AWS emr medium security documentation change
Summary
Updated CLI references from AWS Q to Kiro CLI, modified S3 bucket configuration parameters, changed encryption default from KMS to S3, and added EMRServerlessS3LogPath parameter
Security assessment
The change to default encryption from KMS (true) to S3 (false) reduces default security controls. KMS provides managed keys with audit capabilities, while default S3 encryption uses AWS-managed keys with less granular control. This could expose data if users don't explicitly enable KMS.
Diff
diff --git a/emr/latest/ReleaseGuide/emr-spark-upgrade-agent-setup.md b/emr/latest/ReleaseGuide/emr-spark-upgrade-agent-setup.md index 852c1ccb1..c81781766 100644 --- a//emr/latest/ReleaseGuide/emr-spark-upgrade-agent-setup.md +++ b//emr/latest/ReleaseGuide/emr-spark-upgrade-agent-setup.md @@ -15 +15 @@ The Apache Spark Upgrade Agent uses cross-region inference to process natural la -Before we begin our setup process for integration with AWS Q CLI, make sure you have the following installed on your workstation: +Before we begin our setup process for integration with Kiro CLI, make sure you have the following installed on your workstation: @@ -23 +23 @@ Before we begin our setup process for integration with AWS Q CLI, make sure you - * [ Install Amazon Q Developer CLI ](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/what-is.html) + * [ Install Kiro CLI ](https://kiro.dev/docs/cli/) @@ -32 +32 @@ Before we begin our setup process for integration with AWS Q CLI, make sure you -You can use an CloudFormation template to setup the resource for the MCP server. These templates are samples that you should modify to meet your requirements. You may also review the template and launch the template by yourself. The template creates the following resources for the upgrade process: +You can use an CloudFormation template to setup the resource for the MCP server. These templates are samples that you should modify to meet your requirements. The template creates the following resources for the upgrade process: @@ -69 +69 @@ Proceed to the **Specify stack details** page, enter the **Stack name**. Enter a - * **StagingBucketName** \- Amazon S3 bucket name for staging artifacts (if not provided, the upgrade process auto-generates the name starting with `spark-upgrade` and a suffix generated from stack id for uniqueness. + * **StagingBucketPath** \- Amazon S3 path for staging artifacts (e.g., s3://my-bucket/spark-upgrade or my-bucket/spark-upgrade). Leave empty to auto-generate a new bucket @@ -71 +71 @@ Proceed to the **Specify stack details** page, enter the **Stack name**. Enter a - * **UseS3Encryption** \- Enable KMS encryption for Amazon S3 staging bucket (default: true, set to false for default SSE-S3 encryption) + * **UseS3Encryption** \- Enable KMS encryption for Amazon S3 staging bucket (default: false, set to true to use KMS encryption instead of default S3 encryption) @@ -76,0 +77,2 @@ Proceed to the **Specify stack details** page, enter the **Stack name**. Enter a + * **EMRServerlessS3LogPath** \- (Optional) S3 path where EMR-Serverless application logs are stored (e.g., s3://my-bucket/emr-serverless-logs or my-bucket/emr-serverless-logs). When provided, grants the IAM role read access to these logs for analysis. Only used when EnableEMRServerless is true +