Configure IAM roles for EMRFS requests to Amazon S3

To update the trust policy of an IAM role

Open the IAM console at https://console.aws.amazon.com/iam/.

1. Choose Roles, enter the name of the role in Search, and then select its Role name.

2. Choose Trust relationships, Edit trust relationship.

3. Add a trust statement according to the Policy document according to the guidelines above, and then choose Update trust policy.

To specify IAM roles for EMRFS requests to Amazon S3 using the console

1. Create a security configuration that specifies role mappings:

   1. In the Amazon EMR console, select Security configurations, Create.

   2. Type a Name for the security configuration. You use this name to specify the security configuration when you create a cluster.

   3. Choose Use IAM roles for EMRFS requests to Amazon S3.

   4. Select an IAM role to apply, and under Basis for access select an identifier type (Users, Groups, or S3 prefixes) from the list and enter corresponding identifiers. If you use multiple identifiers, separate them with a comma and no space. For more information about each identifier type, see the JSON configuration reference below.

   5. Choose Add role to set up additional role mappings as described in the previous step.

   6. Set up other security configuration options as appropriate and choose Create. For more information, see Create a security configuration.

2. Specify the security configuration you created above when you create a cluster. For more information, see Specify a security configuration for a cluster.

To specify IAM roles for EMRFS requests to Amazon S3 using the AWS CLI

1. Use the aws emr create-security-configuration command, specifying a name for the security configuration, and the security configuration details in JSON format.

   The example command shown below creates a security configuration with the name EMRFS_Roles_Security_Configuration. It is based on a JSON structure in the file MyEmrfsSecConfig.json, which is saved in the same directory where the command is executed.

   aws emr create-security-configuration --name EMRFS_Roles_Security_Configuration --security-configuration file://MyEmrFsSecConfig.json.

   Use the following guidelines for the structure of the MyEmrFsSecConfig.json file. You can specify this structure along with structures for other security configuration options. For more information, see Create a security configuration.

   The following is an example JSON snippet for specifying custom IAM roles for EMRFS within a security configuration. It demonstrates role mappings for the three different identifier types, followed by a parameter reference.

   {
     "AuthorizationConfiguration": {
       "EmrFsConfiguration": {
         "RoleMappings": [{
           "Role": "arn:aws:iam::123456789101:role/allow_EMRFS_access_for_user1",
           "IdentifierType": "User",
           "Identifiers": [ "user1" ]
         },{
           "Role": "arn:aws:iam::123456789101:role/allow_EMRFS_access_to_MyBuckets",
           "IdentifierType": "Prefix",
           "Identifiers": [ "s3://MyBucket/","s3://MyOtherBucket/" ]
         },{
           "Role": "arn:aws:iam::123456789101:role/allow_EMRFS_access_for_AdminGroup",
           "IdentifierType": "Group",
           "Identifiers": [ "AdminGroup" ]
         }]
       }
     }
   }
   

   Parameter	Description
   "AuthorizationConfiguration":	Required.
   "EmrFsConfiguration":	Required. Contains role mappings.
   "RoleMappings":	Required. Contains one or more role mapping definitions. Role mappings are evaluated in the top-down order that they appear. If a role mapping evaluates as true for an EMRFS call for data in Amazon S3, no further role mappings are evaluated and EMRFS uses the specified IAM role for the request. Role mappings consist of the following required parameters:
   "Role":	Specifies the ARN identifier of an IAM role in the format arn:aws:iam::account-id:role/role-name. This is the IAM role that Amazon EMR assumes if the EMRFS request to Amazon S3 matches any of the Identifiers specified.
   "IdentifierType":	Can be one of the following: "User" specifies that the identifiers are one or more Hadoop users, which can be Linux account users or Kerberos principals. When the EMRFS request originates with the user or users specified, the IAM role is assumed. "Prefix" specifies that the identifier is an Amazon S3 location. The IAM role is assumed for calls to the location or locations with the specified prefixes. For example, the prefix s3://mybucket/ matches s3://mybucket/mydir and s3://mybucket/yetanotherdir. "Group" specifies that the identifiers are one or more Hadoop groups. The IAM role is assumed if the request originates from a user in the specified group or groups.
   "Identifiers":	Specifies one or more identifiers of the appropriate identifier type. Separate multiple identifiers by commas with no spaces.

2. Use the aws emr create-cluster command to create a cluster and specify the security configuration you created in the previous step.

   The following example creates a cluster with default core Hadoop applications installed. The cluster uses the security configuration created above as EMRFS_Roles_Security_Configuration and also uses a custom Amazon EMR role for EC2, EC2_Role_EMR_Restrict_S3, which is specified using the InstanceProfile argument of the --ec2-attributes parameter.

   Note

   Linux line continuation characters (\) are included for readability. They can be removed or used in Linux commands. For Windows, remove them or replace with a caret (^).

   aws emr create-cluster --name MyEmrFsS3RolesCluster \
   --release-label emr-7.0.0 --ec2-attributes InstanceProfile=EC2_Role_EMR_Restrict_S3,KeyName=MyKey \
   --instance-type m5.xlarge --instance-count 3 \
   --security-configuration EMRFS_Roles_Security_Configuration