IAM policies for tag-based access to clusters and EMR notebooks
You can use conditions in your identity-based policy to control access to clusters and EMR notebooks based on tags.
For more information about adding tags to clusters, see Tagging EMR clusters. For more information about using condition keys, see Condition keys.
The following examples demonstrate different scenarios and ways to use condition operators with Amazon EMR condition keys. These IAM policy statements are intended for demonstration purposes only and should not be used in production environments. There are multiple ways to combine policy statements to grant and deny permissions according to your requirements. For more information about planning and testing IAM policies, see the IAM User Guide.
Explicitly denying permission for tagging actions is an important consideration. This prevents users from tagging a resource and thereby granting themselves permissions that you did not intend to grant. If tagging actions for a resource are not denied, a user can modify tags and circumvent the intention of the tag-based policies. For an example of a policy that denies tagging actions, see Deny access to add and remove tags.
Example identity-based policy statements for clusters
The following examples demonstrate identity-based permissions policies that are used to control the actions that are allowed with EMR clusters.
The ModifyInstanceGroup
action in Amazon EMR does not require that you specify a cluster ID. For that reason, denying this action based on cluster tags requires additional consideration. For more information, see Denying the ModifyInstanceGroup action.
Topics
Allow actions only on clusters with specific tag values
The following examples demonstrate a policy that allows a user to perform actions based on the
cluster tag
with the value department
and also allows a user to tag clusters with that same tag. The final policy example demonstrates how to deny privileges to tag EMR clusters with anything but that same tag.dev
In the following policy example, the StringEquals
condition operator tries to
match
with the value for the
tag dev
. If the tag
department
hasn't been
added to the cluster, or doesn't contain the value
department
, the policy doesn't
apply, and the actions aren't allowed by this policy. If no other policy
statements allow the actions, the user can only work with clusters that have
this tag with this value.dev
{ "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt12345678901234", "Effect": "Allow", "Action": [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListSteps", "elasticmapreduce:TerminateJobFlows", "elasticmapreduce:SetTerminationProtection", "elasticmapreduce:ListInstances", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:DescribeStep" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/department": "dev" } } } ] }
You can also specify multiple tag values using a condition operator. For
example, to allow all actions on clusters where the
tag contains
the value department
or
dev
, you could replace
the condition block in the earlier example with the following. test
"Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/department":["dev", "test"] } }
Require cluster tagging when a cluster is created
As in the preceding example, the following example policy looks for the same matching
tag: the value
for the dev
tag. In this case,
however, the department
RequestTag
condition key
specifies that the policy applies during tag creation, so the user must
create a cluster with a tag that matches the specified value. For the PassRole
resource, you need to provide the AWS account ID or alias, and the service
role name. For more information about the IAM ARN format, see IAM ARNs in the IAM User Guide.
For more information specifying matching tag-key values, see aws:RequestTag/tag-key
in the IAM User Guide.
{ "Version": "2012-10-17", "Statement": [{ "Sid": "RunJobFlowExplicitlyWithTag", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/department": "dev" } } }, { "Sid": "PolicyPassroleXYZ", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::
AccountId
:role/Role-Name-With-Path
" ] } ] }
Deny access to add and remove tags
In the following example, the EMR actions that allow the addition and removal of tags is combined with a StringNotEquals
operator specifying the dev
tag we've seen in earlier examples. This policy prevents a user from adding or removing tags on EMR clusters with a
tag whose value is not department
.dev
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags" ], "Condition": { "StringNotEquals": { "elasticmapreduce:ResourceTag/department": "dev" } }, "Resource": [ "*" ] } ] }
Allow actions on clusters with a specific tag, regardless of tag value
You can also allow actions only on clusters that have a particular tag, regardless of the
tag value. To do this, you can use the Null
operator. For
more information, see Condition operator to check existence of condition keys in the
IAM User Guide. For example, to allow actions only on
EMR clusters that have the
tag, regardless of
the value it contains, you could replace the Condition blocks in the earlier
example with the following one. The department
Null
operator looks for
the presence of the tag
on an EMR cluster. If the tag exists, the department
Null
statement
evaluates to false, matching the condition specified in this policy statement,
and the appropriate actions are allowed.
"Condition": { "Null": { "elasticmapreduce:ResourceTag/department":"false" } }
The following policy statement allows a user to create an EMR cluster only if the cluster
will have a
tag, which
can contain any value. For the department
PassRole
resource, you need to provide the AWS account ID or alias, and the service
role name. For more information about the IAM ARN format, see IAM ARNs in the IAM User Guide.
For more information specifying the null ("false") condition operator, see Condition operator to check existence of condition keys in the IAM User Guide.
{ "Version": "2012-10-17", "Statement": [{ "Sid": "PolicyCreateClusterTagNullPassroleXYZ", "Effect": "Allow", "Action": [ "elasticmapreduce:RunJobFlow" ], "Resource": [ "*" ], "Condition": { "Null": { "aws:RequestTag/department": "false" } } }, { "Sid": "PolicyPassroleXYZ", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::
AccountId
:role/Role-Name-With-Path
" ] } ] }
Example identity-based policy statements for EMR Notebooks
The example IAM policy statements in this section demonstrate common scenarios for using keys to limit allowed actions using EMR Notebooks. As long as no other policy associated with the principal (user) allows the actions, the condition context keys limit allowed actions as indicated.
Example – Allow access only to EMR Notebooks that a user creates based on tagging
The following example policy statement, when attached to a role or user, allows the IAM user to work only with notebooks that they have created. This policy statement uses the default tag applied when a notebook is created.
In the example, the StringEquals
condition operator tries to match a variable representing the current users IAM user ID ({aws:userId}
) with the value of the tag creatorUserID
. If the tag creatorUserID
hasn't been added to the notebook, or doesn't contain the value of the current user's ID, the policy doesn't apply, and the actions aren't allowed by this policy. If no other policy statements allow the actions, the user can only work with notebooks that have this tag with this value.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:DescribeEditor", "elasticmapreduce:StartEditor", "elasticmapreduce:StopEditor", "elasticmapreduce:DeleteEditor", "elasticmapreduce:OpenEditorInConsole" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/creatorUserId": "${aws:userId}" } } } ] }
Example –Require notebook tagging when a notebook is created
In this example, the RequestTag
context key is used. The CreateEditor
action is allowed only if the user does not change or delete the creatorUserID
tag is added by default. The variable ${aws:userId}, specifies the currently active user's User ID, which is the default value of the tag.
The policy statement can be used to help ensure that users do not remove the createUserId
tag or change its value.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:CreateEditor" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "elasticmapreduce:RequestTag/creatorUserId": "${aws:userid}" } } } ] }
This example requires that the user create the cluster with a tag having the key string dept
and a value set to one of the following: datascience
, analytics
, operations
.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:CreateEditor" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "elasticmapreduce:RequestTag/dept": [ "datascience", "analytics", "operations" ] } } } ] }
Example –Limit notebook creation to tagged clusters, and require notebook tags
This example allows notebook creation only if the notebook is created with
a tag that has the key string owner
set to one of the specified
values. In addition, the notebook can be created only if the cluster has a
tag with the key string department
set to one of the specified
values.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:CreateEditor" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "elasticmapreduce:RequestTag/owner": [ "owner1", "owner2", "owner3" ], "elasticmapreduce:ResourceTag/department": [ "dep1", "dep3" ] } } } ] }
Example –Limit the ability to start a notebook based on tags
This example limits the ability to start notebooks only to those notebooks that have a tag with the key string owner
set to one of the specified values. Because the Resource
element is used to specify only the editor
, the condition does not apply to the cluster, and it does not need to be tagged.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:StartEditor" ], "Effect": "Allow", "Resource": "arn:aws:elasticmapreduce:*:123456789012:editor/*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/owner": [ "owner1", "owner2" ] } } } ] }
This example is similar to one above. However, the limit only applies to tagged clusters, not notebooks.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:StartEditor" ], "Effect": "Allow", "Resource": "arn:aws:elasticmapreduce:*:123456789012:cluster/*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/department": [ "dep1", "dep3" ] } } } ] }
This example uses a different set of notebook and cluster tags. It allows a notebook to be started only if:
The notebook has a tag with the key string
owner
set to any of the specified values—and—
The cluster has a tag with the key string
department
set to any of the specified values
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:StartEditor" ], "Effect": "Allow", "Resource": "arn:aws:elasticmapreduce:*:123456789012:editor/*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/owner": [ "user1", "user2" ] } } }, { "Action": [ "elasticmapreduce:StartEditor" ], "Effect": "Allow", "Resource": "arn:aws:elasticmapreduce:*:123456789012:cluster/*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/department": [ "datascience", "analytics" ] } } } ] }
Example –Limit the ability to open the notebook editor based on tags
This example allows the notebook editor to be opened only if:
The notebook has a tag with the key string
owner
set to any of the specified values.—and—
The cluster has a tag with the key string
department
set to any of the specified values.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "elasticmapreduce:OpenEditorInConsole" ], "Effect": "Allow", "Resource": "arn:aws:elasticmapreduce:*:123456789012:editor/*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/owner": [ "user1", "user2" ] } } }, { "Action": [ "elasticmapreduce:OpenEditorInConsole" ], "Effect": "Allow", "Resource": "arn:aws:elasticmapreduce:*:123456789012:cluster/*", "Condition": { "StringEquals": { "elasticmapreduce:ResourceTag/department": [ "datascience", "analytics" ] } } } ] }