AWS emr medium security documentation change
Summary
Added a warning note about the consequences of accidentally deleting and recreating an IAM Role for IAM Identity Center, which changes the principal ID and breaks downstream resource policies.
Security assessment
This change documents a specific security consideration: if an IAM Role is recreated, its principal ID changes, causing a mismatch with existing resource policies and potentially breaking access controls. This is a security documentation addition that warns about a scenario that could lead to unintended access denials or require manual policy updates, highlighting an operational security implication.
Diff
diff --git a/emr/latest/ManagementGuide/emr-idc-considerations.md b/emr/latest/ManagementGuide/emr-idc-considerations.md index 7d0b77169..97b2a7b49 100644 --- a//emr/latest/ManagementGuide/emr-idc-considerations.md +++ b//emr/latest/ManagementGuide/emr-idc-considerations.md @@ -80,0 +81,2 @@ Consider the following points when you use IAM Identity Center with Amazon EMR: + * If the IAM Role for identity center role is accidentally deleted and recreated, the principal will have a different principal-id. Example `NewRole` would have principal-id `456` which would not match the recorded principal-id `123`. The only way to resolve this at this point is to re-set the principal in the downstream resource policies in every downstream account. +