aws-emr-pass-job-flow-role
iam:PassRole for the EMR instance profile / JobFlowRole, required by RunJobFlow.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has elasticmapreduce:RunJobFlow
iam:PassedToService condition (if any) includes elasticmapreduce.amazonaws.com or ec2.amazonaws.com
role trust policy allows ec2.amazonaws.com (instance profile trust)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <JobFlowRole (instance profile role)> |
| permissions | iam:PassRole elasticmapreduce:RunJobFlow |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} as the EMR instance profile (JobFlowRole) when creating a cluster (iam:PassRole + elasticmapreduce:RunJobFlow); the cluster then executes as {role.name}.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-pass-job-flow-role
emits: CanPassIdentity
description: iam:PassRole for the EMR instance profile / JobFlowRole, required by RunJobFlow.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- principal has elasticmapreduce:RunJobFlow
- iam:PassedToService condition (if any) includes elasticmapreduce.amazonaws.com or ec2.amazonaws.com
- role trust policy allows ec2.amazonaws.com (instance profile trust)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <JobFlowRole (instance profile role)>
permissions:
- iam:PassRole
- elasticmapreduce:RunJobFlow
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: Honor iam:PassedToService and the role ARN scope. A role passable only to lambda.amazonaws.com
or ecs-tasks.amazonaws.com cannot serve as a JobFlowRole. The instance profile's trust must allow
ec2.amazonaws.com. If the PassedToService condition is absent or includes a wildcard, the constraint
is permissive.
narrative: '{principal.name} can pass {role.name} as the EMR instance profile (JobFlowRole) when creating
a cluster (iam:PassRole + elasticmapreduce:RunJobFlow); the cluster then executes as {role.name}.'