创建 EMR Studio 服务角色 - Amazon EMR

创建 EMR Studio 服务角色

关于 EMR Studio 服务角色

每个 EMR Studio 都使用一个 IAM 角色,该角色具有允许 Studio 与其它 AWS 服务进行交互的权限。此服务角色必须包括允许 EMR Studio 在 Workspaces 和集群之间建立安全网络通道、将笔记本文件存储在 Amazon S3 Control 中以及在将 Workspace 链接到 Git 存储库时访问 AWS Secrets Manager 的权限。

使用 Studio 服务角色(而不是会话策略)定义所有 Amazon S3 访问权限以存储笔记本文件,并定义 AWS Secrets Manager 访问权限。

如何为 EMR Studio 创建服务角色

  1. 按照创建角色以将权限委派给AWS服务中的说明使用以下信任策略创建服务角色。

    重要

    下面的信任策略包括 aws:SourceArnaws:SourceAccount 全局条件密钥,用于限制您为 EMR Studio 授予的、针对您账户中特定资源的权限。这样做可以防止混淆代理人问题

    { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "elasticmapreduce.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<account-id>" }, "ArnLike": { "aws:SourceArn": "arn:aws:elasticmapreduce:<region>:<account-id>:*" } } } ] }
  2. 删除默认角色权限。然后,包括下面的示例 IAM 权限策略中的权限。或者,您也可以创建使用 EMR Studio 服务角色权限 的自定义策略。

    如果适用,请更改以下策略中的 "Resource":"*",以便为您的使用案例指定该语句涵盖的一个或多个资源的 Amazon Resource Name (ARN)。

    重要
    • 要访问 ModifyNetworkInterfaceAttribute API,以下策略内容必须保持不变,因为受到 Amazon EC2 标记的访问控制以及 EMR Studio 使用 ModifyNetworkInterfaceAttribute 方式的技术限制。

    • 为了让 EMR Studio 与服务角色 AllowAddingEMRTagsDuringDefaultSecurityGroupCreationAllowAddingTagsDuringEC2ENICreation 配合使用,以下语句必须保持不变。

    • 要您使用示例策略,必须使用密钥 "for-use-with-amazon-emr-managed-policies" 和值 "true" 标记以下资源。

      • 用于 EMR Studio 的 Amazon Virtual Private Cloud (VPC)。

      • 您要与 Studio 配合使用的每个子网。

      • 任何自定义 EMR Studio 安全组。如果您想继续使用在 EMR Studio 预览期间创建的安全组,则必须标记它们。

      • 在 AWS Secrets Manager 中维护的 Studio 用户用于将 Git 存储库链接到 Workspace 的密钥。

      您可以在AWS Management Console中,使用相关资源屏幕上的 Tags (标签) 选项卡将标签应用于资源。

    { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowEMRReadOnlyActions", "Effect": "Allow", "Action": [ "elasticmapreduce:ListInstances", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListSteps" ], "Resource": "*" }, { "Sid": "AllowEC2ENIActionsWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowEC2ENIAttributeAction", "Effect": "Allow", "Action": [ "ec2:ModifyNetworkInterfaceAttribute" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*" ] }, { "Sid": "AllowEC2SecurityGroupActionsWithEMRTags", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteNetworkInterfacePermission" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowDefaultEC2SecurityGroupsCreationWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:*:*:vpc/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowAddingEMRTagsDuringDefaultSecurityGroupCreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true", "ec2:CreateAction": "CreateSecurityGroup" } } }, { "Sid": "AllowEC2ENICreationWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "StringEquals": { "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowEC2ENICreationInSubnetAndSecurityGroupWithEMRTags", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowAddingTagsDuringEC2ENICreation", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Sid": "AllowEC2ReadOnlyActions", "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource": "*" }, { "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringEquals": { "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" } } }, { "Sid": "AllowWorkspaceCollaboration", "Effect": "Allow", "Action": [ "iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "sso:GetManagedApplicationInstance", "sso-directory:SearchUsers" ], "Resource": "*" } ] }
  3. 为您的服务角色授予对用于 EMR Studio 的 Amazon S3 位置的读写权限。使用以下最小权限集。有关更多信息,请参阅 Amazon S3:允许以编程方式和在控制台中对 S3 Bucket 中的对象进行读写访问示例。

    "s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:ListBucket", "s3:DeleteObject"

    如果您加密了 Amazon S3 存储桶,您必须为 AWS Key Management Service包含以下权限。

    "kms:Decrypt", "kms:GenerateDataKey", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:DescribeKey"

EMR Studio 服务角色权限

下表列出了 EMR Studio 使用服务角色运行的运算,以及每项运算所需的 IAM 操作。

运算 操作
在 Workspace 和 EMR 集群之间建立安全的网络通道,并执行必要的清理操作。
"ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:ModifyNetworkInterfaceAttribute", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "elasticmapreduce:ListInstances", "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListSteps"
使用存储在 AWS Secrets Manager 中的 Git 凭证将 Git 存储库链接到 Workspace。
"secretsmanager:GetSecretValue"
将AWS标签应用于 EMR Studio 在设置安全网络通道时创建的网络接口和默认安全组。有关更多信息,请参阅标记AWS资源
"ec2:CreateTags"
访问笔记本文件和元数据或将它们上传到 Amazon S3。
"s3:PutObject", "s3:GetObject", "s3:GetEncryptionConfiguration", "s3:ListBucket", "s3:DeleteObject"

如果您使用 加密的 Amazon S3 存储桶,则必须包含以下权限。

"kms:Decrypt", "kms:GenerateDataKey", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:DescribeKey"
启用和配置 Workspace 协作。
"iam:GetUser", "iam:GetRole", "iam:ListUsers", "iam:ListRoles", "sso:GetManagedApplicationInstance", "sso-directory:SearchUsers"