aws-emr-on-eks-pass-job-role
iam:PassRole for the EMR on EKS job execution role, required by emrcontainers:StartJobRun.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has emr-containers:StartJobRun
iam:PassedToService condition (if any) includes emr-containers.amazonaws.com
role trust policy allows EKS OIDC provider (IRSA) for the target virtual cluster
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <EMR on EKS job execution role> |
| permissions | iam:PassRole emr-containers:StartJobRun |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} as the EMR on EKS job execution role (iam:PassRole + emr-containers:StartJobRun); a submitted job run then executes as {role.name} via IRSA.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-on-eks-pass-job-role
emits: CanPassIdentity
description: iam:PassRole for the EMR on EKS job execution role, required by emrcontainers:StartJobRun.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- principal has emr-containers:StartJobRun
- iam:PassedToService condition (if any) includes emr-containers.amazonaws.com
- role trust policy allows EKS OIDC provider (IRSA) for the target virtual cluster
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <EMR on EKS job execution role>
permissions:
- iam:PassRole
- emr-containers:StartJobRun
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: emr-containers.amazonaws.com must be in the PassedToService condition (if set).
The role's trust must allow the EKS OIDC provider for the target virtual cluster's namespace (IRSA
binding). Without this, the pod cannot assume the role even when PassRole succeeds.
narrative: '{principal.name} can pass {role.name} as the EMR on EKS job execution role (iam:PassRole
+ emr-containers:StartJobRun); a submitted job run then executes as {role.name} via IRSA.'