AWS emr medium security documentation change
Summary
Added identical documentation about EMR 6.9.0 cross-account database fix and permission workaround to release history
Security assessment
This change replicates security documentation about preventing cross-account misconfigurations in AWS Glue. The added IAM permission guidance directly addresses access control risks where incorrect resource creation could lead to privilege or data exposure issues.
Diff
diff --git a/emr/latest/ReleaseGuide/emr-whatsnew-history.md b/emr/latest/ReleaseGuide/emr-whatsnew-history.md index f262355ea..7dffa38d0 100644 --- a//emr/latest/ReleaseGuide/emr-whatsnew-history.md +++ b//emr/latest/ReleaseGuide/emr-whatsnew-history.md @@ -611,0 +612,19 @@ With [Amazon EMR 6.10.0](./emr-6100-release.html#emr-6100-relnotes), there's a w + * **Cross-account default database behavior (fixed in Amazon EMR 6.9.0)** — In Amazon EMR releases earlier than 6.9.0, even if the `hive.metastore.glue.catalogid` setting is configured in Spark or Hive sites for cross-account AWS Glue Data Catalog access, Amazon EMR checks for the default database in the current account and attempts to create it in the current account if not found, rather than using the configured cross-account catalog. This could cause permissions issues if the Amazon EMR EC2 instance profile role does not have AWS Glue permissions on the current account's catalog. + +This issue is fixed in Amazon EMR 6.9.0 and later. For earlier releases, add the following permissions to the Amazon EMR EC2 instance profile role for the current account: + + { + "Effect": "Allow", + "Action": [ + "glue:GetDatabase", + "glue:GetDatabases", + "glue:CreateDatabase" + ], + "Resource": [ + "arn:aws:glue:*:123456789012:catalog", + "arn:aws:glue:*:123456789012:database/default" + ] + } + +Replace `123456789012` with your current account ID (not the cross-account ID). +