Terminated with errors - Service role My-EMR-Role has insufficient EC2 permissions

user_4725074 0
Viewed 679

I'm using My-EMR-Role copying and pasting the policy posted in this AWS Guide https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-role.html

When using this configuration:

EMR role: My-EMR-Role
EC2 instance profile: EMR_EC2_DefaultRole

seems to be working.

But when for example I use:

EMR role: My-EMR-Role 
EC2 instance profile: My_EMR_EC2_DefaultRole

where My_EMR_EC2_DefaultRole is using the same policy instance of EMR_EC2_DefaultRole the cluster fails with error message:

Terminated with errors - Service role Test-EMR has insufficient EC2 permissions

which is weird as role My-EMR-Role was working when paired with EMR_EC2_DefaultRole - again, both EMR_EC2_DefaultRole and My_EMR_EC2_DefaultRole are referring to the same policy instance AmazonElasticMapReduceforEC2Role provided by AWS.

How come receiving this error when using exactly the same policies?

amazon-emr amazon-iam apache-spark amazon-web-services
1 Answers

By looking at the policy provided in this article https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-role.html it is possible to see that the last element PassRoleForEC2 has a resource restriction based on the name of the role EMR_EC2_DefaultRole:

    {
        "Sid": "PassRoleForEC2",
        "Effect": "Allow",
        "Action": "iam:PassRole",
        "Resource": "arn:aws:iam::*:role/EMR_EC2_DefaultRole",
        "Condition": {
            "StringLike": {
                "iam:PassedToService": "ec2.amazonaws.com*"
            }
        }
    }

So to make it work with the new created role that resource has to be changed with My_EMR_EC2_DefaultRole and the resource becomes:

        "Resource": "arn:aws:iam::*:role/My_EMR_EC2_DefaultRole",
user_47250740
Related