aws-emr-serverless-executes-as-exec-role
An EMR Serverless job run executes as the executionRoleArn provided at StartJobRun.
match (record)
{
"field": "jobRun.executionRoleArn",
"resource_type": "AWS::EMRServerless::JobRun"
}
where
job run state is RUNNING or SUBMITTED
emit
| source type | AnalyticsService |
|---|---|
| target type | Identity |
| source | <EMR Serverless Job Run> |
| target | <executionRoleArn> |
| conditions | service_state |
Narrative
EMR Serverless job run {jobrun.name} executes as {role.name} (executionRoleArn supplied at StartJobRun); Spark/Hive applications running inside it hold those credentials via the EMR credential relay endpoint.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-serverless-executes-as-exec-role
emits: ExecutesAs
description: An EMR Serverless job run executes as the executionRoleArn provided at StartJobRun.
match_record:
resource_type: AWS::EMRServerless::JobRun
field: jobRun.executionRoleArn
where:
- job run state is RUNNING or SUBMITTED
emit:
source_type: AnalyticsService
target_type: Identity
source: <EMR Serverless Job Run>
target: <executionRoleArn>
state: ACTIVE
conditions:
- service_state
api_source: emrserverless:GetJobRun
evidence_field: jobRun.executionRoleArn
false_positive_note: "EMR Serverless uses a credential relay mechanism (not IMDS); the role is only\
\ accessible to code running inside the serverless job. The executionRoleArn is explicitly required\
\ at StartJobRun \u2014 PassRole is always enforced; a missing or denied PassRole prevents submission."
narrative: EMR Serverless job run {jobrun.name} executes as {role.name} (executionRoleArn supplied at
StartJobRun); Spark/Hive applications running inside it hold those credentials via the EMR credential
relay endpoint.