AWS emr medium security documentation change
Summary
Added documentation about cross-account default database behavior fix in EMR 6.9.0 and workaround permissions for earlier versions
Security assessment
This change documents a fix for a permission misconfiguration issue where EMR created resources in the wrong AWS account during cross-account operations. The explicit permissions workaround (glue:GetDatabase, glue:CreateDatabase etc.) addresses potential privilege escalation risks and unintended resource access.
Diff
diff --git a/emr/latest/ReleaseGuide/emr-690-release.md b/emr/latest/ReleaseGuide/emr-690-release.md index fca438536..9ad22061d 100644 --- a//emr/latest/ReleaseGuide/emr-690-release.md +++ b//emr/latest/ReleaseGuide/emr-690-release.md @@ -143,0 +144,19 @@ With [Amazon EMR 6.10.0](./emr-6100-release.html#emr-6100-relnotes), there's a w + * **Cross-account default database behavior (fixed in Amazon EMR 6.9.0)** — In Amazon EMR releases earlier than 6.9.0, even if the `hive.metastore.glue.catalogid` setting is configured in Spark or Hive sites for cross-account AWS Glue Data Catalog access, Amazon EMR checks for the default database in the current account and attempts to create it in the current account if not found, rather than using the configured cross-account catalog. This could cause permissions issues if the Amazon EMR EC2 instance profile role does not have AWS Glue permissions on the current account's catalog. + +This issue is fixed in Amazon EMR 6.9.0 and later. For earlier releases, add the following permissions to the Amazon EMR EC2 instance profile role for the current account: + + { + "Effect": "Allow", + "Action": [ + "glue:GetDatabase", + "glue:GetDatabases", + "glue:CreateDatabase" + ], + "Resource": [ + "arn:aws:glue:*:123456789012:catalog", + "arn:aws:glue:*:123456789012:database/default" + ] + } + +Replace `123456789012` with your current account ID (not the cross-account ID). +