aws-emr-pass-service-role
iam:PassRole for the EMR ServiceRole (elasticmapreduce.amazonaws.com), required by RunJobFlow.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has elasticmapreduce:RunJobFlow
iam:PassedToService condition (if any) includes elasticmapreduce.amazonaws.com (NOT ec2.amazonaws.com)
role trust policy allows elasticmapreduce.amazonaws.com (service principal)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <ServiceRole> |
| permissions | iam:PassRole elasticmapreduce:RunJobFlow |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} as the EMR service control role (iam:PassRole + elasticmapreduce:RunJobFlow); the role is used by the EMR control plane to manage cluster infrastructure and resources.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-pass-service-role
emits: CanPassIdentity
description: iam:PassRole for the EMR ServiceRole (elasticmapreduce.amazonaws.com), required by RunJobFlow.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- principal has elasticmapreduce:RunJobFlow
- iam:PassedToService condition (if any) includes elasticmapreduce.amazonaws.com (NOT ec2.amazonaws.com)
- role trust policy allows elasticmapreduce.amazonaws.com (service principal)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <ServiceRole>
permissions:
- iam:PassRole
- elasticmapreduce:RunJobFlow
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: "The ServiceRole is required separately from JobFlowRole. Both must be passable\
\ for RunJobFlow to succeed. Honor iam:PassedToService \u2014 a role passable only to ec2.amazonaws.com\
\ or other services cannot serve as the ServiceRole. The trust policy must explicitly allow elasticmapreduce.amazonaws.com."
narrative: '{principal.name} can pass {role.name} as the EMR service control role (iam:PassRole + elasticmapreduce:RunJobFlow);
the role is used by the EMR control plane to manage cluster infrastructure and resources.'