AWS emr medium security documentation change

Service: emr · 2026-04-25 · Security-related medium

File: emr/latest/ReleaseGuide/emr-spark-redshift-auth.md

Summary

Updated IAM policy example for Redshift authentication to include Principal service specification and add aws:SourceAccount condition to AssumeRole statement

Security assessment

The change adds a source account condition to the AssumeRole policy, which is a security best practice that prevents confused deputy problems by restricting which AWS accounts can assume the role. This directly addresses potential security vulnerabilities where unauthorized accounts could assume the Redshift service role.

Diff

diff --git a/emr/latest/ReleaseGuide/emr-spark-redshift-auth.md b/emr/latest/ReleaseGuide/emr-spark-redshift-auth.md
index d7f95c8f8..2abf04c2e 100644
--- a//emr/latest/ReleaseGuide/emr-spark-redshift-auth.md
+++ b//emr/latest/ReleaseGuide/emr-spark-redshift-auth.md
@@ -79,0 +80 @@ JSON
+          "Sid": "AllowSTSAssumerole",
@@ -81,5 +82,9 @@ JSON
-          "Action": [
-            "sts:AssumeRole"
-          ],
-          "Resource": "arn:aws:iam::123456789012:role/RedshiftServiceRole",
-          "Sid": "AllowSTSAssumerole"
+          "Principal": {
+            "Service": "redshift.amazonaws.com"
+          },
+          "Action": "sts:AssumeRole",
+          "Condition": {
+            "StringEquals": {
+              "aws:SourceAccount": "123456789012"
+            }
+          }