AWS emr: Update cross-account Glue and IAM example ARNs to concrete values
Summary
Placeholder REGION/ACCOUNT IDs in the cross-account Glue catalog and instance profile role example policies were replaced with concrete example values.
Security assessment
Placeholder substitution in cross-account example policies; the permission structure is unchanged.
Evidence
"arn:aws:glue:us-east-1:111122223333:catalog",
Diff
diff --git a/emr/latest/ManagementGuide/emr-trusted-identity-cross-account.md b/emr/latest/ManagementGuide/emr-trusted-identity-cross-account.md index a9d1877..9b6aae9 100644 --- a//emr/latest/ManagementGuide/emr-trusted-identity-cross-account.md +++ b//emr/latest/ManagementGuide/emr-trusted-identity-cross-account.md @@ -382,6 +382,6 @@ The EC2 instance profile role for your EMR cluster in Account B must be able to - "arn:aws:glue:REGION:ACCOUNT_B_ID:catalog", - "arn:aws:glue:REGION:ACCOUNT_B_ID:database/*", - "arn:aws:glue:REGION:ACCOUNT_B_ID:table/*", - "arn:aws:glue:REGION:ACCOUNT_A_ID:catalog", - "arn:aws:glue:REGION:ACCOUNT_A_ID:database/*", - "arn:aws:glue:REGION:ACCOUNT_A_ID:table/*" + "arn:aws:glue:us-east-1:111122223333:catalog", + "arn:aws:glue:us-east-1:111122223333:database/*", + "arn:aws:glue:us-east-1:111122223333:table/*", + "arn:aws:glue:us-east-1:444455556666:catalog", + "arn:aws:glue:us-east-1:444455556666:database/*", + "arn:aws:glue:us-east-1:444455556666:table/*" @@ -405 +405 @@ The instance profile role must be allowed to assume itself, which is how the car - "Resource": "arn:aws:iam::ACCOUNT_B_ID:role/INSTANCE_PROFILE_ROLE" + "Resource": "arn:aws:iam::111122223333:role/INSTANCE_PROFILE_ROLE"