aws-emr-add-steps-code
elasticmapreduce:AddJobFlowSteps lets a principal inject arbitrary executable steps into a running cluster.
match (effective permission)
{
"action": "elasticmapreduce:AddJobFlowSteps",
"resource_type": "AWS::EMR::Cluster"
}
where
cluster state is WAITING or RUNNING
emit
| source type | Identity |
|---|---|
| target type | AnalyticsService |
| source | <principal> |
| target | <EMR Cluster (AnalyticsService)> |
| permissions | elasticmapreduce:AddJobFlowSteps |
| conditions | iam_permission service_state |
Narrative
{principal.name} can submit executable steps to EMR cluster {cluster.name} (elasticmapreduce:AddJobFlowSteps); steps run as the cluster's existing instance profile (JobFlowRole) without requiring iam:PassRole.
Raw rule rules/derived/aws/emr.yaml
id: aws-emr-add-steps-code
emits: CanModifyCode
description: elasticmapreduce:AddJobFlowSteps lets a principal inject arbitrary executable steps into
a running cluster.
match_effective_permission:
action: elasticmapreduce:AddJobFlowSteps
resource_type: AWS::EMR::Cluster
where:
- cluster state is WAITING or RUNNING
emit:
source_type: Identity
target_type: AnalyticsService
source: <principal>
target: <EMR Cluster (AnalyticsService)>
permissions:
- elasticmapreduce:AddJobFlowSteps
conditions:
- iam_permission
- service_state
false_positive_note: "AddJobFlowSteps does NOT require iam:PassRole \u2014 the step runs as the cluster's\
\ existing instance profile. Only valid when the cluster is in WAITING or RUNNING state; emit CONDITIONAL(service_state)\
\ otherwise. IAM condition keys (aws:RequestedRegion, aws:ResourceTag) may narrow scope \u2014 honor\
\ them."
narrative: '{principal.name} can submit executable steps to EMR cluster {cluster.name} (elasticmapreduce:AddJobFlowSteps);
steps run as the cluster''s existing instance profile (JobFlowRole) without requiring iam:PassRole.'