AWS emr: Remove CreatePresignedUrl permission and update example ARNs
Summary
The example DataZone user role policy drops the emr-serverless:CreatePresignedUrl action and replaces placeholder ARNs with concrete example values.
Security assessment
Removing a permission from an example policy reduces granted privileges (least-privilege hardening), though it is documentation guidance rather than a fixed vulnerability.
Evidence
- "emr-serverless:CreatePresignedUrl",
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/tutorial-tip-smus.md b/emr/latest/EMR-Serverless-UserGuide/tutorial-tip-smus.md index 16a55ee..31a8ff0 100644 --- a//emr/latest/EMR-Serverless-UserGuide/tutorial-tip-smus.md +++ b//emr/latest/EMR-Serverless-UserGuide/tutorial-tip-smus.md @@ -338 +338 @@ Attach permissions for the downstream services the job will access. The role nee - "Resource": "arn:aws:logs:region:account-id:*" + "Resource": "arn:aws:logs:us-east-1:111122223333:*" @@ -465 +464,0 @@ The DataZone user role for the project environment must have permissions to inte - "emr-serverless:CreatePresignedUrl", @@ -478 +477 @@ The DataZone user role for the project environment must have permissions to inte - "Resource": "arn:aws:iam::account-id:role/emr-serverless-tip-job-role", + "Resource": "arn:aws:iam::111122223333:role/emr-serverless-tip-job-role",