aws-emr-on-eks-executes-as-job-role
An EMR on EKS job run executes as the IAM role bound to the virtual cluster's job execution binding (IRSA).
match (record)
{
"field": "jobRun.executionRoleArn",
"resource_type": "AWS::EMRContainers::JobRun"
}
where
virtual cluster exists and job run state is RUNNING or SUBMITTED
emit
| source type | AnalyticsService |
|---|---|
| target type | Identity |
| source | <EMR on EKS Job Run> |
| target | <job execution role (WorkloadIdentity / Role)> |
| conditions | service_state |
Narrative
EMR on EKS job run {jobrun.name} executes as {role.name} via the IRSA binding on the EKS virtual cluster; job pods retrieve those credentials via the pod identity/OIDC token exchange.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-on-eks-executes-as-job-role
emits: ExecutesAs
description: An EMR on EKS job run executes as the IAM role bound to the virtual cluster's job execution
binding (IRSA).
match_record:
resource_type: AWS::EMRContainers::JobRun
field: jobRun.executionRoleArn
where:
- virtual cluster exists and job run state is RUNNING or SUBMITTED
emit:
source_type: AnalyticsService
target_type: Identity
source: <EMR on EKS Job Run>
target: <job execution role (WorkloadIdentity / Role)>
state: ACTIVE
conditions:
- service_state
api_source: emrcontainers:DescribeJobRun
evidence_field: jobRun.executionRoleArn
false_positive_note: The job execution role must have a trust relationship allowing the EKS OIDC provider
(IRSA) for the EKS cluster namespace where the virtual cluster pods run. If the IRSA binding is missing
or misconfigured, the execution role is not reachable from within the pod.
narrative: EMR on EKS job run {jobrun.name} executes as {role.name} via the IRSA binding on the EKS
virtual cluster; job pods retrieve those credentials via the pod identity/OIDC token exchange.