Skip to content

Commit f3fd183

Browse files
lpizzinidevlpizzinidev
authored
fix(stepfunctions-tasks): updated EMR service role to use AmazonEMRServicePolicy_v2 (under feature flag) (#23985)
Closes #23915 **Summary** Changed EMR used policies from `AmazonElasticMapReduceRole` to `AmazonEMRServicePolicy_v2` as by [documentation](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html). *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 02c9d98 commit f3fd183

24 files changed

+1507
-1
lines changed

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/emr-create-cluster.ts

+11
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import * as iam from '@aws-cdk/aws-iam';
22
import * as sfn from '@aws-cdk/aws-stepfunctions';
33
import * as cdk from '@aws-cdk/core';
4+
import { ENABLE_EMR_SERVICE_POLICY_V2 } from '@aws-cdk/cx-api';
45
import { Construct } from 'constructs';
56
import {
67
ApplicationConfigPropertyToJson,
@@ -340,6 +341,16 @@ export class EmrCreateCluster extends sfn.TaskStateBase {
340341
* Generate the Role used by the EMR Service
341342
*/
342343
private createServiceRole(): iam.IRole {
344+
if (cdk.FeatureFlags.of(this).isEnabled(ENABLE_EMR_SERVICE_POLICY_V2)) {
345+
return new iam.Role(this, 'ServiceRole', {
346+
assumedBy: new iam.ServicePrincipal('elasticmapreduce.amazonaws.com', {
347+
conditions: {
348+
StringEquals: { 'aws:RequestTag/for-use-with-amazon-emr-managed-policies': 'true' },
349+
},
350+
}),
351+
managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonEMRServicePolicy_v2')],
352+
});
353+
}
343354
return new iam.Role(this, 'ServiceRole', {
344355
assumedBy: new iam.ServicePrincipal('elasticmapreduce.amazonaws.com'),
345356
managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonElasticMapReduceRole')],

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/package.json

+1
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@
116116
"@aws-cdk/aws-stepfunctions": "0.0.0",
117117
"@aws-cdk/core": "0.0.0",
118118
"@aws-cdk/custom-resources": "0.0.0",
119+
"@aws-cdk/cx-api": "^0.0.0",
119120
"@aws-cdk/lambda-layer-awscli": "0.0.0",
120121
"constructs": "^10.0.0"
121122
},

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/emr-create-cluster.test.ts

+87
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ import { Template } from '@aws-cdk/assertions';
22
import * as iam from '@aws-cdk/aws-iam';
33
import * as sfn from '@aws-cdk/aws-stepfunctions';
44
import * as cdk from '@aws-cdk/core';
5+
// eslint-disable-next-line import/no-extraneous-dependencies
6+
import { ENABLE_EMR_SERVICE_POLICY_V2 } from '@aws-cdk/cx-api';
57
import { EmrCreateCluster } from '../../lib';
68

79
let stack: cdk.Stack;
@@ -681,7 +683,92 @@ test('Create Cluster without Roles', () => {
681683
],
682684
},
683685
});
686+
});
687+
688+
test('Create Cluster with AmazonElasticMapReduceRole managed policies', () => {
689+
// WHEN
690+
const app = new cdk.App({ context: { [ENABLE_EMR_SERVICE_POLICY_V2]: false } });
691+
const newStack = new cdk.Stack(app, 'NewStack');
692+
693+
new EmrCreateCluster(newStack, 'Task', {
694+
instances: {},
695+
name: 'Cluster',
696+
integrationPattern: sfn.IntegrationPattern.RUN_JOB,
697+
});
698+
699+
// THEN
700+
Template.fromStack(newStack).hasResourceProperties('AWS::IAM::Role', {
701+
AssumeRolePolicyDocument: {
702+
Version: '2012-10-17',
703+
Statement: [
704+
{
705+
Principal: { Service: 'elasticmapreduce.amazonaws.com' },
706+
Action: 'sts:AssumeRole',
707+
Effect: 'Allow',
708+
},
709+
],
710+
},
711+
ManagedPolicyArns: [
712+
{
713+
'Fn::Join': [
714+
'',
715+
[
716+
'arn:',
717+
{
718+
Ref: 'AWS::Partition',
719+
},
720+
':iam::aws:policy/service-role/AmazonElasticMapReduceRole',
721+
],
722+
],
723+
},
724+
],
725+
});
726+
});
684727

728+
729+
test('Create Cluster with AmazonEMRServicePolicy_v2 managed policies', () => {
730+
// WHEN
731+
const app = new cdk.App({ context: { [ENABLE_EMR_SERVICE_POLICY_V2]: true } });
732+
const newStack = new cdk.Stack(app, 'NewStack');
733+
734+
new EmrCreateCluster(newStack, 'Task', {
735+
instances: {},
736+
name: 'Cluster',
737+
integrationPattern: sfn.IntegrationPattern.RUN_JOB,
738+
});
739+
740+
// THEN
741+
Template.fromStack(newStack).hasResourceProperties('AWS::IAM::Role', {
742+
AssumeRolePolicyDocument: {
743+
Version: '2012-10-17',
744+
Statement: [
745+
{
746+
Principal: { Service: 'elasticmapreduce.amazonaws.com' },
747+
Action: 'sts:AssumeRole',
748+
Effect: 'Allow',
749+
Condition: {
750+
StringEquals: {
751+
'aws:RequestTag/for-use-with-amazon-emr-managed-policies': 'true',
752+
},
753+
},
754+
},
755+
],
756+
},
757+
ManagedPolicyArns: [
758+
{
759+
'Fn::Join': [
760+
'',
761+
[
762+
'arn:',
763+
{
764+
Ref: 'AWS::Partition',
765+
},
766+
':iam::aws:policy/service-role/AmazonEMRServicePolicy_v2',
767+
],
768+
],
769+
},
770+
],
771+
});
685772
});
686773

687774
test('Create Cluster with Instances configuration', () => {

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-v1-policy.js.snapshot/EmrCreateClusterTestDefaultTestDeployAssert697DC891.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "30.1.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "EmrCreateClusterTestDefaultTestDeployAssert697DC891.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-v1-policy.js.snapshot/EmrCreateClusterTestDefaultTestDeployAssert697DC891.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-v1-policy.js.snapshot/aws-cdk-emr-create-cluster.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "30.1.0",
3+
"files": {
4+
"0469b61284a24ccea8f9d02b4cd584ade969ef4c117cd51be3ce5576365f73cd": {
5+
"source": {
6+
"path": "aws-cdk-emr-create-cluster.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "0469b61284a24ccea8f9d02b4cd584ade969ef4c117cd51be3ce5576365f73cd.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-v1-policy.js.snapshot/aws-cdk-emr-create-cluster.template.json

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
{
2+
"Resources": {
3+
"EmrCreateClusterServiceRole5251910D": {
4+
"Type": "AWS::IAM::Role",
5+
"Properties": {
6+
"AssumeRolePolicyDocument": {
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Condition": {
11+
"StringEquals": {
12+
"aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
13+
}
14+
},
15+
"Effect": "Allow",
16+
"Principal": {
17+
"Service": "elasticmapreduce.amazonaws.com"
18+
}
19+
}
20+
],
21+
"Version": "2012-10-17"
22+
},
23+
"ManagedPolicyArns": [
24+
{
25+
"Fn::Join": [
26+
"",
27+
[
28+
"arn:",
29+
{
30+
"Ref": "AWS::Partition"
31+
},
32+
":iam::aws:policy/service-role/AmazonEMRServicePolicy_v2"
33+
]
34+
]
35+
}
36+
]
37+
}
38+
},
39+
"EmrCreateClusterInstanceRoleC80466F5": {
40+
"Type": "AWS::IAM::Role",
41+
"Properties": {
42+
"AssumeRolePolicyDocument": {
43+
"Statement": [
44+
{
45+
"Action": "sts:AssumeRole",
46+
"Effect": "Allow",
47+
"Principal": {
48+
"Service": "ec2.amazonaws.com"
49+
}
50+
}
51+
],
52+
"Version": "2012-10-17"
53+
}
54+
}
55+
},
56+
"EmrCreateClusterInstanceProfileC1729180": {
57+
"Type": "AWS::IAM::InstanceProfile",
58+
"Properties": {
59+
"Roles": [
60+
{
61+
"Ref": "EmrCreateClusterInstanceRoleC80466F5"
62+
}
63+
],
64+
"InstanceProfileName": {
65+
"Ref": "EmrCreateClusterInstanceRoleC80466F5"
66+
}
67+
}
68+
},
69+
"EmrCreateClusterAutoScalingRoleFDDAF4E2": {
70+
"Type": "AWS::IAM::Role",
71+
"Properties": {
72+
"AssumeRolePolicyDocument": {
73+
"Statement": [
74+
{
75+
"Action": "sts:AssumeRole",
76+
"Effect": "Allow",
77+
"Principal": {
78+
"Service": [
79+
"application-autoscaling.amazonaws.com",
80+
"elasticmapreduce.amazonaws.com"
81+
]
82+
}
83+
}
84+
],
85+
"Version": "2012-10-17"
86+
},
87+
"ManagedPolicyArns": [
88+
{
89+
"Fn::Join": [
90+
"",
91+
[
92+
"arn:",
93+
{
94+
"Ref": "AWS::Partition"
95+
},
96+
":iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole"
97+
]
98+
]
99+
}
100+
]
101+
}
102+
}
103+
},
104+
"Parameters": {
105+
"BootstrapVersion": {
106+
"Type": "AWS::SSM::Parameter::Value<String>",
107+
"Default": "/cdk-bootstrap/hnb659fds/version",
108+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
109+
}
110+
},
111+
"Rules": {
112+
"CheckBootstrapVersion": {
113+
"Assertions": [
114+
{
115+
"Assert": {
116+
"Fn::Not": [
117+
{
118+
"Fn::Contains": [
119+
[
120+
"1",
121+
"2",
122+
"3",
123+
"4",
124+
"5"
125+
],
126+
{
127+
"Ref": "BootstrapVersion"
128+
}
129+
]
130+
}
131+
]
132+
},
133+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
134+
}
135+
]
136+
}
137+
}
138+
}

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-v1-policy.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"30.1.0"}

Diff for: ‎packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-with-v1-policy.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "30.1.0",
3+
"testCases": {
4+
"EmrCreateClusterTest/DefaultTest": {
5+
"stacks": [
6+
"aws-cdk-emr-create-cluster"
7+
],
8+
"assertionStack": "EmrCreateClusterTest/DefaultTest/DeployAssert",
9+
"assertionStackName": "EmrCreateClusterTestDefaultTestDeployAssert697DC891"
10+
}
11+
}
12+
}

0 commit comments

Comments
 (0)