AmazonElasticMapReduceforEC2Role

High privilegeAdminService roleActivePermissions reviewedShow on map Compare

Summary

Default policy for the Amazon Elastic MapReduce for EC2 service role.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role
Default version: v3
Created: 2015-02-06
Last edited: 2017-08-11
Services: cloudwatch, dynamodb, ec2, elasticmapreduce, glue, kinesis, rds, s3, sdb, sns, sqs

Control-plane actions (744)

By access level: 298 List, 41 Permissions management, 174 Read, 16 Tagging, 215 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	All 160 actions (see the CloudWatch page)	24 List, 8 Permissions management, 46 Read, 2 Tagging, 80 Write; 0 restricted, 0 conditional	cloudwatch:*
DynamoDB	All 68 actions (see the DynamoDB page)	7 List, 3 Permissions management, 22 Read, 2 Tagging, 34 Write; 0 restricted, 0 conditional	dynamodb:*
EC2	195 of 834	195 List; 0 restricted, 0 conditional	ec2:Describe*
EMR	15 of 88	1 List, 14 Read; 0 restricted, 0 conditional	elasticmapreduce:Describe*, elasticmapreduce:ListBootstrapActions, elasticmapreduce:ListClusters, elasticmapreduce:ListInstanceGroups, elasticmapreduce:ListInstances, elasticmapreduce:ListSteps
Glue	24 of 306	10 Read, 14 Write; 0 restricted, 0 conditional	glue:BatchCreatePartition, glue:BatchDeletePartition, glue:BatchGetPartition, glue:CreateDatabase, glue:CreatePartition, glue:CreateTable, glue:CreateUserDefinedFunction, glue:DeleteDatabase, glue:DeletePartition, glue:DeleteTable, glue:DeleteUserDefinedFunction, glue:GetDatabase and 12 more
Kinesis	5 of 42	1 Read, 4 Write; 0 restricted, 0 conditional	kinesis:CreateStream, kinesis:DeleteStream, kinesis:DescribeStream, kinesis:MergeShards, kinesis:SplitShard
RDS	49 of 173	47 List, 2 Read; 0 restricted, 0 conditional	rds:Describe*
S3	All 155 actions (see the S3 page)	15 List, 24 Permissions management, 58 Read, 8 Tagging, 50 Write; 0 restricted, 0 conditional	s3:*
SimpleDB	All 13 actions (see the SimpleDB page)	2 List, 4 Read, 7 Write; 0 restricted, 0 conditional	sdb:*
SNS	All 40 actions (see the SNS page)	7 List, 3 Permissions management, 10 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	sns:*
SQS	All 20 actions (see the SQS page)	3 Permissions management, 7 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	sqs:*

EC2: 195 actions

ec2:DescribeAccountAttributes (List)
ec2:DescribeAccountVpcEncryptionControl (List)
ec2:DescribeAddressTransfers (List)
ec2:DescribeAddresses (List)
ec2:DescribeAddressesAttribute (List)
ec2:DescribeAggregateIdFormat (List)
ec2:DescribeApplicationStatus (List)
ec2:DescribeApplicationStatusCheckAssociations (List)
ec2:DescribeApplicationStatusChecks (List)
ec2:DescribeAvailabilityZones (List)
ec2:DescribeAwsNetworkPerformanceMetricSubscriptions (List)
ec2:DescribeBundleTasks (List)
ec2:DescribeByoipCidrs (List)
ec2:DescribeCapacityBlockExtensionHistory (List)
ec2:DescribeCapacityBlockExtensionOfferings (List)
ec2:DescribeCapacityBlockOfferings (List)
ec2:DescribeCapacityBlockStatus (List)
ec2:DescribeCapacityBlocks (List)
ec2:DescribeCapacityManagerDataExports (List)
ec2:DescribeCapacityReservationBillingRequests (List)
ec2:DescribeCapacityReservationCancellationQuotes (List)
ec2:DescribeCapacityReservationDateChangeQuotes (List)
ec2:DescribeCapacityReservationFleets (List)
ec2:DescribeCapacityReservationTopology (List)
ec2:DescribeCapacityReservations (List)
ec2:DescribeCarrierGateways (List)
ec2:DescribeClassicLinkInstances (List)
ec2:DescribeClientVpnAuthorizationRules (List)
ec2:DescribeClientVpnConnections (List)
ec2:DescribeClientVpnEndpoints (List)
ec2:DescribeClientVpnRoutes (List)
ec2:DescribeClientVpnTargetNetworks (List)
ec2:DescribeCoipPools (List)
ec2:DescribeConversionTasks (List)
ec2:DescribeCustomerGateways (List)
ec2:DescribeDeclarativePoliciesReports (List)
ec2:DescribeDhcpOptions (List)
ec2:DescribeEgressOnlyInternetGateways (List)
ec2:DescribeElasticGpus (List)
ec2:DescribeExportImageTasks (List)
ec2:DescribeExportTasks (List)
ec2:DescribeFastLaunchImages (List)
ec2:DescribeFastSnapshotRestores (List)
ec2:DescribeFleetHistory (List)
ec2:DescribeFleetInstances (List)
ec2:DescribeFleets (List)
ec2:DescribeFlowLogs (List)
ec2:DescribeFpgaImageAttribute (List)
ec2:DescribeFpgaImages (List)
ec2:DescribeHostReservationOfferings (List)
ec2:DescribeHostReservations (List)
ec2:DescribeHosts (List)
ec2:DescribeIamInstanceProfileAssociations (List)
ec2:DescribeIdFormat (List)
ec2:DescribeIdentityIdFormat (List)
ec2:DescribeImageAttribute (List)
ec2:DescribeImageReferences (List)
ec2:DescribeImageUsageReportEntries (List)
ec2:DescribeImageUsageReports (List)
ec2:DescribeImages (List)
ec2:DescribeImportImageTasks (List)
ec2:DescribeImportSnapshotTasks (List)
ec2:DescribeInstanceAttribute (List)
ec2:DescribeInstanceConnectEndpoints (List)
ec2:DescribeInstanceCreditSpecifications (List)
ec2:DescribeInstanceEventNotificationAttributes (List)
ec2:DescribeInstanceEventWindows (List)
ec2:DescribeInstanceImageMetadata (List)
ec2:DescribeInstanceSqlHaHistoryStates (List)
ec2:DescribeInstanceSqlHaStates (List)
ec2:DescribeInstanceStatus (List)
ec2:DescribeInstanceTopology (List)
ec2:DescribeInstanceTypeOfferings (List)
ec2:DescribeInstanceTypes (List)
ec2:DescribeInstances (List)
ec2:DescribeInternetGateways (List)
ec2:DescribeIpamByoasn (List)
ec2:DescribeIpamExternalResourceVerificationTokens (List)
ec2:DescribeIpamInternetRegistryAssociations (List)
ec2:DescribeIpamPolicies (List)
ec2:DescribeIpamPoolAllocations (List)
ec2:DescribeIpamPools (List)
ec2:DescribeIpamPrefixListResolverTargets (List)
ec2:DescribeIpamPrefixListResolvers (List)
ec2:DescribeIpamResourceDiscoveries (List)
ec2:DescribeIpamResourceDiscoveryAssociations (List)
ec2:DescribeIpamScopes (List)
ec2:DescribeIpams (List)
ec2:DescribeIpv6Pools (List)
ec2:DescribeKeyPairs (List)
ec2:DescribeLaunchTemplateVersions (List)
ec2:DescribeLaunchTemplates (List)
ec2:DescribeLocalGatewayRouteTablePermissions (List)
ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations (List)
ec2:DescribeLocalGatewayRouteTableVpcAssociations (List)
ec2:DescribeLocalGatewayRouteTables (List)
ec2:DescribeLocalGatewayVirtualInterfaceGroups (List)
ec2:DescribeLocalGatewayVirtualInterfaces (List)
ec2:DescribeLocalGateways (List)
ec2:DescribeLockedSnapshots (List)
ec2:DescribeMacHosts (List)
ec2:DescribeMacModificationTasks (List)
ec2:DescribeManagedPrefixLists (List)
ec2:DescribeMovingAddresses (List)
ec2:DescribeNatGateways (List)
ec2:DescribeNetworkAcls (List)
ec2:DescribeNetworkInsightsAccessScopeAnalyses (List)
ec2:DescribeNetworkInsightsAccessScopes (List)
ec2:DescribeNetworkInsightsAnalyses (List)
ec2:DescribeNetworkInsightsPaths (List)
ec2:DescribeNetworkInterfaceAttribute (List)
ec2:DescribeNetworkInterfacePermissions (List)
ec2:DescribeNetworkInterfaces (List)
ec2:DescribeOutpostLags (List)
ec2:DescribePlacementGroups (List)
ec2:DescribePrefixLists (List)
ec2:DescribePrincipalIdFormat (List)
ec2:DescribePublicIpv4Pools (List)
ec2:DescribeRegions (List)
ec2:DescribeReplaceRootVolumeTasks (List)
ec2:DescribeReservedInstances (List)
ec2:DescribeReservedInstancesListings (List)
ec2:DescribeReservedInstancesModifications (List)
ec2:DescribeReservedInstancesOfferings (List)
ec2:DescribeRouteServerEndpoints (List)
ec2:DescribeRouteServerPeers (List)
ec2:DescribeRouteServers (List)
ec2:DescribeRouteTables (List)
ec2:DescribeScheduledInstanceAvailability (List)
ec2:DescribeScheduledInstances (List)
ec2:DescribeSecondaryInterfaces (List)
ec2:DescribeSecondaryNetworks (List)
ec2:DescribeSecondarySubnets (List)
ec2:DescribeSecurityGroupReferences (List)
ec2:DescribeSecurityGroupRules (List)
ec2:DescribeSecurityGroupVpcAssociations (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeServiceLinkVirtualInterfaces (List)
ec2:DescribeSnapshotAttribute (List)
ec2:DescribeSnapshotTierStatus (List)
ec2:DescribeSnapshots (List)
ec2:DescribeSpotDatafeedSubscription (List)
ec2:DescribeSpotFleetInstances (List)
ec2:DescribeSpotFleetRequestHistory (List)
ec2:DescribeSpotFleetRequests (List)
ec2:DescribeSpotInstanceRequests (List)
ec2:DescribeSpotPriceHistory (List)
ec2:DescribeStaleSecurityGroups (List)
ec2:DescribeStoreImageTasks (List)
ec2:DescribeSubnets (List)
ec2:DescribeTags (List)
ec2:DescribeTrafficMirrorFilterRules (List)
ec2:DescribeTrafficMirrorFilters (List)
ec2:DescribeTrafficMirrorSessions (List)
ec2:DescribeTrafficMirrorTargets (List)
ec2:DescribeTransitGatewayAttachments (List)
ec2:DescribeTransitGatewayConnectPeers (List)
ec2:DescribeTransitGatewayConnects (List)
ec2:DescribeTransitGatewayMeteringPolicies (List)
ec2:DescribeTransitGatewayMulticastDomains (List)
ec2:DescribeTransitGatewayPeeringAttachments (List)
ec2:DescribeTransitGatewayPolicyTables (List)
ec2:DescribeTransitGatewayRouteTableAnnouncements (List)
ec2:DescribeTransitGatewayRouteTables (List)
ec2:DescribeTransitGatewayVpcAttachments (List)
ec2:DescribeTransitGateways (List)
ec2:DescribeTrunkInterfaceAssociations (List)
ec2:DescribeVerifiedAccessEndpoints (List)
ec2:DescribeVerifiedAccessGroups (List)
ec2:DescribeVerifiedAccessInstanceLoggingConfigurations (List)
ec2:DescribeVerifiedAccessInstanceWebAclAssociations (List)
ec2:DescribeVerifiedAccessInstances (List)
ec2:DescribeVerifiedAccessTrustProviders (List)
ec2:DescribeVolumeAttribute (List)
ec2:DescribeVolumeStatus (List)
ec2:DescribeVolumes (List)
ec2:DescribeVolumesModifications (List)
ec2:DescribeVpcAttribute (List)
ec2:DescribeVpcBlockPublicAccessExclusions (List)
ec2:DescribeVpcBlockPublicAccessOptions (List)
ec2:DescribeVpcClassicLink (List)
ec2:DescribeVpcClassicLinkDnsSupport (List)
ec2:DescribeVpcEncryptionControls (List)
ec2:DescribeVpcEndpointAssociations (List)
ec2:DescribeVpcEndpointConnectionNotifications (List)
ec2:DescribeVpcEndpointConnections (List)
ec2:DescribeVpcEndpointServiceConfigurations (List)
ec2:DescribeVpcEndpointServicePermissions (List)
ec2:DescribeVpcEndpointServices (List)
ec2:DescribeVpcEndpoints (List)
ec2:DescribeVpcPeeringConnections (List)
ec2:DescribeVpcs (List)
ec2:DescribeVpnConcentrators (List)
ec2:DescribeVpnConnections (List)
ec2:DescribeVpnGateways (List)

EMR: 15 actions

elasticmapreduce:DescribeCluster (Read)
elasticmapreduce:DescribeEditor (Read)
elasticmapreduce:DescribeJobFlows (Read)
elasticmapreduce:DescribeNotebookExecution (Read)
elasticmapreduce:DescribePersistentAppUI (Read)
elasticmapreduce:DescribeReleaseLabel (Read)
elasticmapreduce:DescribeRepository (Read)
elasticmapreduce:DescribeSecurityConfiguration (Read)
elasticmapreduce:DescribeStep (Read)
elasticmapreduce:DescribeStudio (Read)
elasticmapreduce:ListBootstrapActions (Read)
elasticmapreduce:ListClusters (List)
elasticmapreduce:ListInstanceGroups (Read)
elasticmapreduce:ListInstances (Read)
elasticmapreduce:ListSteps (Read)

Glue: 24 actions

glue:BatchCreatePartition (Write)
glue:BatchDeletePartition (Write)
glue:BatchGetPartition (Read)
glue:CreateDatabase (Write)
glue:CreatePartition (Write)
glue:CreateTable (Write)
glue:CreateUserDefinedFunction (Write)
glue:DeleteDatabase (Write)
glue:DeletePartition (Write)
glue:DeleteTable (Write)
glue:DeleteUserDefinedFunction (Write)
glue:GetDatabase (Read)
glue:GetDatabases (Read)
glue:GetPartition (Read)
glue:GetPartitions (Read)
glue:GetTable (Read)
glue:GetTableVersions (Read)
glue:GetTables (Read)
glue:GetUserDefinedFunction (Read)
glue:GetUserDefinedFunctions (Read)
glue:UpdateDatabase (Write)
glue:UpdatePartition (Write)
glue:UpdateTable (Write)
glue:UpdateUserDefinedFunction (Write)

Kinesis: 5 actions

kinesis:CreateStream (Write)
kinesis:DeleteStream (Write)
kinesis:DescribeStream (Read)
kinesis:MergeShards (Write)
kinesis:SplitShard (Write)

RDS: 49 actions

rds:DescribeAccountAttributes (List)
rds:DescribeBlueGreenDeployments (List)
rds:DescribeCertificates (List)
rds:DescribeDBCapacityReservations (List)
rds:DescribeDBClusterAutomatedBackups (List)
rds:DescribeDBClusterBacktracks (List)
rds:DescribeDBClusterEndpoints (List)
rds:DescribeDBClusterParameterGroups (List)
rds:DescribeDBClusterParameters (List)
rds:DescribeDBClusterSnapshotAttributes (List)
rds:DescribeDBClusterSnapshots (List)
rds:DescribeDBClusters (List)
rds:DescribeDBEngineVersions (List)
rds:DescribeDBInstanceAutomatedBackups (List)
rds:DescribeDBInstances (List)
rds:DescribeDBLogFiles (List)
rds:DescribeDBMajorEngineVersions (List)
rds:DescribeDBParameterGroups (List)
rds:DescribeDBParameters (List)
rds:DescribeDBProxies (List)
rds:DescribeDBProxyEndpoints (List)
rds:DescribeDBProxyTargetGroups (List)
rds:DescribeDBProxyTargets (List)
rds:DescribeDBRecommendations (List)
rds:DescribeDBSecurityGroups (List)
rds:DescribeDBShardGroups (List)
rds:DescribeDBSnapshotAttributes (List)
rds:DescribeDBSnapshotTenantDatabases (List)
rds:DescribeDBSnapshots (List)
rds:DescribeDBSubnetGroups (List)
rds:DescribeEngineDefaultClusterParameters (List)
rds:DescribeEngineDefaultParameters (List)
rds:DescribeEventCategories (List)
rds:DescribeEventSubscriptions (List)
rds:DescribeEvents (List)
rds:DescribeExportTasks (List)
rds:DescribeGlobalClusters (List)
rds:DescribeIntegrations (List)
rds:DescribeOptionGroupOptions (List)
rds:DescribeOptionGroups (List)
rds:DescribeOrderableDBInstanceOptions (List)
rds:DescribePendingMaintenanceActions (List)
rds:DescribeRecommendationGroups (Read)
rds:DescribeRecommendations (Read)
rds:DescribeReservedDBInstances (List)
rds:DescribeReservedDBInstancesOfferings (List)
rds:DescribeSourceRegions (List)
rds:DescribeTenantDatabases (List)
rds:DescribeValidDBInstanceModifications (List)

Data-plane actions (51)

By access level: 4 List, 3 Permissions management, 22 Read, 4 Tagging, 18 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	All 5 actions (see the CloudWatch page)	1 List, 3 Read, 1 Write; 0 restricted, 0 conditional	cloudwatch:*
DynamoDB	All 17 actions (see the DynamoDB page)	9 Read, 8 Write; 0 restricted, 0 conditional	dynamodb:*
Kinesis	3 of 5	2 Read, 1 Write; 0 restricted, 0 conditional	kinesis:GetRecords, kinesis:GetShardIterator, kinesis:PutRecord
S3	All 25 actions (see the S3 page)	3 List, 3 Permissions management, 8 Read, 4 Tagging, 7 Write; 0 restricted, 0 conditional	s3:*
SNS	All 1 actions (see the SNS page)	1 Write; 0 restricted, 0 conditional	sns:*

Kinesis: 3 actions

kinesis:GetRecords (Read)
kinesis:GetShardIterator (Read)
kinesis:PutRecord (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: cloudwatch (89 of 89), dynamodb (45 of 45), s3 (84 of 84), sdb (7 of 7), sns (22 of 22), sqs (11 of 11).
Grants data-plane write actions on a data store on all resources without conditions.
27 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "cloudwatch:*",
        "dynamodb:*",
        "ec2:Describe*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:ListBootstrapActions",
        "elasticmapreduce:ListClusters",
        "elasticmapreduce:ListInstanceGroups",
        "elasticmapreduce:ListInstances",
        "elasticmapreduce:ListSteps",
        "kinesis:CreateStream",
        "kinesis:DeleteStream",
        "kinesis:DescribeStream",
        "kinesis:GetRecords",
        "kinesis:GetShardIterator",
        "kinesis:MergeShards",
        "kinesis:PutRecord",
        "kinesis:SplitShard",
        "rds:Describe*",
        "s3:*",
        "sdb:*",
        "sns:*",
        "sqs:*",
        "glue:CreateDatabase",
        "glue:UpdateDatabase",
        "glue:DeleteDatabase",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:CreateTable",
        "glue:UpdateTable",
        "glue:DeleteTable",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetTableVersions",
        "glue:CreatePartition",
        "glue:BatchCreatePartition",
        "glue:UpdatePartition",
        "glue:DeletePartition",
        "glue:BatchDeletePartition",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:BatchGetPartition",
        "glue:CreateUserDefinedFunction",
        "glue:UpdateUserDefinedFunction",
        "glue:DeleteUserDefinedFunction",
        "glue:GetUserDefinedFunction",
        "glue:GetUserDefinedFunctions"
      ]
    }
  ]
}

Version history

Current version v3, edited by AWS on 2017-08-11. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role

Terraform

resource "aws_iam_role_policy_attachment" "service_role_amazonelasticmapreduceforec2role" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonElasticMapReduceforEC2Role"),
);

Sources

Pending editorial review. No editorial sources are listed yet.