Skip to content

Commit 81beab3

Browse files
sjaktholsjakthol
authored
feat(stepfunctions-tasks): add elasticmapreduce:AddTags permission for EmrCreateCluster state with tags (#24856)
Beginning April 24, 2023, Amazon Elastic Map Reduce (EMR) will start to require permission for the "elasticmapreduce:AddTags" IAM action when creating an EMR cluster with tags. This commit updates the EmrCreateCluster state to add elasticmapreduce:AddTags action to the state machine execution role when tags have been defined. Closes #24842. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 6da4eba commit 81beab3

File tree

10 files changed

+1084
-0
lines changed

10 files changed

+1084
-0
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-tags.js.snapshot/EmrCreateClusterTestDefaultTestDeployAssert697DC891.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "EmrCreateClusterTestDefaultTestDeployAssert697DC891.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-tags.js.snapshot/EmrCreateClusterTestDefaultTestDeployAssert697DC891.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-tags.js.snapshot/aws-cdk-emr-create-cluster.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"8535838cc39b895502fa6e0a308dd851831b75ca0764b24e626715c1e558c6a4": {
5+
"source": {
6+
"path": "aws-cdk-emr-create-cluster.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "8535838cc39b895502fa6e0a308dd851831b75ca0764b24e626715c1e558c6a4.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-tags.js.snapshot/aws-cdk-emr-create-cluster.template.json

Lines changed: 297 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,297 @@
1+
{
2+
"Resources": {
3+
"EmrCreateClusterServiceRole5251910D": {
4+
"Type": "AWS::IAM::Role",
5+
"Properties": {
6+
"AssumeRolePolicyDocument": {
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Condition": {
11+
"StringEquals": {
12+
"aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
13+
}
14+
},
15+
"Effect": "Allow",
16+
"Principal": {
17+
"Service": "elasticmapreduce.amazonaws.com"
18+
}
19+
}
20+
],
21+
"Version": "2012-10-17"
22+
},
23+
"ManagedPolicyArns": [
24+
{
25+
"Fn::Join": [
26+
"",
27+
[
28+
"arn:",
29+
{
30+
"Ref": "AWS::Partition"
31+
},
32+
":iam::aws:policy/service-role/AmazonEMRServicePolicy_v2"
33+
]
34+
]
35+
}
36+
]
37+
}
38+
},
39+
"EmrCreateClusterInstanceRoleC80466F5": {
40+
"Type": "AWS::IAM::Role",
41+
"Properties": {
42+
"AssumeRolePolicyDocument": {
43+
"Statement": [
44+
{
45+
"Action": "sts:AssumeRole",
46+
"Effect": "Allow",
47+
"Principal": {
48+
"Service": "ec2.amazonaws.com"
49+
}
50+
}
51+
],
52+
"Version": "2012-10-17"
53+
}
54+
}
55+
},
56+
"EmrCreateClusterInstanceProfileC1729180": {
57+
"Type": "AWS::IAM::InstanceProfile",
58+
"Properties": {
59+
"Roles": [
60+
{
61+
"Ref": "EmrCreateClusterInstanceRoleC80466F5"
62+
}
63+
],
64+
"InstanceProfileName": {
65+
"Ref": "EmrCreateClusterInstanceRoleC80466F5"
66+
}
67+
}
68+
},
69+
"EmrCreateClusterAutoScalingRoleFDDAF4E2": {
70+
"Type": "AWS::IAM::Role",
71+
"Properties": {
72+
"AssumeRolePolicyDocument": {
73+
"Statement": [
74+
{
75+
"Action": "sts:AssumeRole",
76+
"Effect": "Allow",
77+
"Principal": {
78+
"Service": [
79+
"application-autoscaling.amazonaws.com",
80+
"elasticmapreduce.amazonaws.com"
81+
]
82+
}
83+
}
84+
],
85+
"Version": "2012-10-17"
86+
},
87+
"ManagedPolicyArns": [
88+
{
89+
"Fn::Join": [
90+
"",
91+
[
92+
"arn:",
93+
{
94+
"Ref": "AWS::Partition"
95+
},
96+
":iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole"
97+
]
98+
]
99+
}
100+
]
101+
}
102+
},
103+
"SMRole49C19C48": {
104+
"Type": "AWS::IAM::Role",
105+
"Properties": {
106+
"AssumeRolePolicyDocument": {
107+
"Statement": [
108+
{
109+
"Action": "sts:AssumeRole",
110+
"Effect": "Allow",
111+
"Principal": {
112+
"Service": "states.amazonaws.com"
113+
}
114+
}
115+
],
116+
"Version": "2012-10-17"
117+
}
118+
}
119+
},
120+
"SMRoleDefaultPolicy34CA15C7": {
121+
"Type": "AWS::IAM::Policy",
122+
"Properties": {
123+
"PolicyDocument": {
124+
"Statement": [
125+
{
126+
"Action": [
127+
"elasticmapreduce:DescribeCluster",
128+
"elasticmapreduce:RunJobFlow",
129+
"elasticmapreduce:TerminateJobFlows"
130+
],
131+
"Effect": "Allow",
132+
"Resource": "*"
133+
},
134+
{
135+
"Action": "iam:PassRole",
136+
"Effect": "Allow",
137+
"Resource": [
138+
{
139+
"Fn::GetAtt": [
140+
"EmrCreateClusterAutoScalingRoleFDDAF4E2",
141+
"Arn"
142+
]
143+
},
144+
{
145+
"Fn::GetAtt": [
146+
"EmrCreateClusterInstanceRoleC80466F5",
147+
"Arn"
148+
]
149+
},
150+
{
151+
"Fn::GetAtt": [
152+
"EmrCreateClusterServiceRole5251910D",
153+
"Arn"
154+
]
155+
}
156+
]
157+
},
158+
{
159+
"Action": "elasticmapreduce:AddTags",
160+
"Effect": "Allow",
161+
"Resource": {
162+
"Fn::Join": [
163+
"",
164+
[
165+
"arn:",
166+
{
167+
"Ref": "AWS::Partition"
168+
},
169+
":elasticmapreduce:",
170+
{
171+
"Ref": "AWS::Region"
172+
},
173+
":",
174+
{
175+
"Ref": "AWS::AccountId"
176+
},
177+
":cluster/*"
178+
]
179+
]
180+
}
181+
},
182+
{
183+
"Action": [
184+
"events:DescribeRule",
185+
"events:PutRule",
186+
"events:PutTargets"
187+
],
188+
"Effect": "Allow",
189+
"Resource": {
190+
"Fn::Join": [
191+
"",
192+
[
193+
"arn:",
194+
{
195+
"Ref": "AWS::Partition"
196+
},
197+
":events:",
198+
{
199+
"Ref": "AWS::Region"
200+
},
201+
":",
202+
{
203+
"Ref": "AWS::AccountId"
204+
},
205+
":rule/StepFunctionsGetEventForEMRRunJobFlowRule"
206+
]
207+
]
208+
}
209+
}
210+
],
211+
"Version": "2012-10-17"
212+
},
213+
"PolicyName": "SMRoleDefaultPolicy34CA15C7",
214+
"Roles": [
215+
{
216+
"Ref": "SMRole49C19C48"
217+
}
218+
]
219+
}
220+
},
221+
"SM934E715A": {
222+
"Type": "AWS::StepFunctions::StateMachine",
223+
"Properties": {
224+
"RoleArn": {
225+
"Fn::GetAtt": [
226+
"SMRole49C19C48",
227+
"Arn"
228+
]
229+
},
230+
"DefinitionString": {
231+
"Fn::Join": [
232+
"",
233+
[
234+
"{\"StartAt\":\"EmrCreateCluster\",\"States\":{\"EmrCreateCluster\":{\"End\":true,\"Type\":\"Task\",\"Resource\":\"arn:",
235+
{
236+
"Ref": "AWS::Partition"
237+
},
238+
":states:::elasticmapreduce:createCluster.sync\",\"Parameters\":{\"Instances\":{\"KeepJobFlowAliveWhenNoSteps\":true},\"JobFlowRole\":\"",
239+
{
240+
"Ref": "EmrCreateClusterInstanceRoleC80466F5"
241+
},
242+
"\",\"Name\":\"Cluster\",\"ServiceRole\":\"",
243+
{
244+
"Ref": "EmrCreateClusterServiceRole5251910D"
245+
},
246+
"\",\"AutoScalingRole\":\"",
247+
{
248+
"Ref": "EmrCreateClusterAutoScalingRoleFDDAF4E2"
249+
},
250+
"\",\"Tags\":[{\"Key\":\"Key\",\"Value\":\"Value\"}],\"VisibleToAllUsers\":true}}}}"
251+
]
252+
]
253+
}
254+
},
255+
"DependsOn": [
256+
"SMRoleDefaultPolicy34CA15C7",
257+
"SMRole49C19C48"
258+
],
259+
"UpdateReplacePolicy": "Delete",
260+
"DeletionPolicy": "Delete"
261+
}
262+
},
263+
"Parameters": {
264+
"BootstrapVersion": {
265+
"Type": "AWS::SSM::Parameter::Value<String>",
266+
"Default": "/cdk-bootstrap/hnb659fds/version",
267+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
268+
}
269+
},
270+
"Rules": {
271+
"CheckBootstrapVersion": {
272+
"Assertions": [
273+
{
274+
"Assert": {
275+
"Fn::Not": [
276+
{
277+
"Fn::Contains": [
278+
[
279+
"1",
280+
"2",
281+
"3",
282+
"4",
283+
"5"
284+
],
285+
{
286+
"Ref": "BootstrapVersion"
287+
}
288+
]
289+
}
290+
]
291+
},
292+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
293+
}
294+
]
295+
}
296+
}
297+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-tags.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-tags.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "31.0.0",
3+
"testCases": {
4+
"EmrCreateClusterTest/DefaultTest": {
5+
"stacks": [
6+
"aws-cdk-emr-create-cluster"
7+
],
8+
"assertionStack": "EmrCreateClusterTest/DefaultTest/DeployAssert",
9+
"assertionStackName": "EmrCreateClusterTestDefaultTestDeployAssert697DC891"
10+
}
11+
}
12+
}

0 commit comments

Comments
 (0)