aws-emr-serverless-pass-exec-role
iam:PassRole for the EMR Serverless executionRoleArn, required by StartJobRun.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
principal has emr-serverless:StartJobRun
iam:PassedToService condition (if any) includes emr-serverless.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <executionRoleArn> |
| permissions | iam:PassRole emr-serverless:StartJobRun |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} as the EMR Serverless execution role (iam:PassRole + emr-serverless:StartJobRun); a submitted job run then executes as {role.name}.
Raw rule rules/explicit/aws-emr.yaml
id: aws-emr-serverless-pass-exec-role
emits: CanPassIdentity
description: iam:PassRole for the EMR Serverless executionRoleArn, required by StartJobRun.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- principal has emr-serverless:StartJobRun
- iam:PassedToService condition (if any) includes emr-serverless.amazonaws.com
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <executionRoleArn>
permissions:
- iam:PassRole
- emr-serverless:StartJobRun
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: emr-serverless.amazonaws.com must be present in the PassedToService condition (if
set); a role passable only to elasticmapreduce.amazonaws.com or another service cannot be an EMR Serverless
executionRoleArn. Without PassRole this job submission fails at the API level.
narrative: '{principal.name} can pass {role.name} as the EMR Serverless execution role (iam:PassRole
+ emr-serverless:StartJobRun); a submitted job run then executes as {role.name}.'