aws-emr-executes-as-instance-profile
An EMR cluster and every step/application running on it execute as the cluster's EC2 instance profile (JobFlowRole).
match (record)
{
"field": "Cluster.Ec2InstanceAttributes.IamInstanceProfile",
"resource_type": "AWS::EMR::Cluster"
}
where
cluster state is WAITING or RUNNING (not TERMINATED/TERMINATING)
emit
| source type | AnalyticsService |
|---|---|
| target type | Identity |
| source | <EMR Cluster> |
| target | <JobFlowRole (instance profile role)> |
| conditions | service_state |
Narrative
EMR cluster {cluster.name} executes as instance profile role {role.name}; every Hadoop/Spark application and submitted step runs with those credentials, which are retrievable from IMDS (http://169.254.169.254) on any EC2 node in the cluster.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-executes-as-instance-profile
emits: ExecutesAs
description: An EMR cluster and every step/application running on it execute as the cluster's EC2 instance
profile (JobFlowRole).
match_record:
resource_type: AWS::EMR::Cluster
field: Cluster.Ec2InstanceAttributes.IamInstanceProfile
where:
- cluster state is WAITING or RUNNING (not TERMINATED/TERMINATING)
emit:
source_type: AnalyticsService
target_type: Identity
source: <EMR Cluster>
target: <JobFlowRole (instance profile role)>
state: ACTIVE
conditions:
- service_state
api_source: elasticmapreduce:DescribeCluster
evidence_field: Cluster.Ec2InstanceAttributes.IamInstanceProfile
false_positive_note: Only emit for clusters in WAITING or RUNNING state. Emit CONDITIONAL(service_state)
for clusters in BOOTSTRAPPING state (instance profile bound but cluster not ready to accept steps).
Do not emit for TERMINATED or TERMINATING clusters.
narrative: EMR cluster {cluster.name} executes as instance profile role {role.name}; every Hadoop/Spark
application and submitted step runs with those credentials, which are retrievable from IMDS (http://169.254.169.254)
on any EC2 node in the cluster.