EMR Serverless Update: This release adds the capability for users to specify an optional Execution IAM policy in the StartJobRun action. The resulting permissions assumed by the job run is the intersection of the permissions in the Execution Role and the specified Execution IAM Policy.

Author: AWS

.changes/next-release/feature-EMRServerless-219ed1b.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "EMR Serverless",
+    "contributor": "",
+    "description": "This release adds the capability for users to specify an optional Execution IAM policy in the StartJobRun action. The resulting permissions assumed by the job run is the intersection of the permissions in the Execution Role and the specified Execution IAM Policy."
+}

services/emrserverless/src/main/resources/codegen-resources/service-2.json

@@ -24,8 +24,8 @@
       "output":{"shape":"CancelJobRunResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Cancels a job run.</p>",
       "idempotent":true
@@ -41,8 +41,8 @@
       "output":{"shape":"CreateApplicationResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
         {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
         {"shape":"ConflictException"}
       ],
       "documentation":"<p>Creates an application.</p>",
@@ -59,8 +59,8 @@
       "output":{"shape":"DeleteApplicationResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Deletes an application. An application has to be in a stopped or created state in order to be deleted.</p>",
       "idempotent":true
@@ -76,8 +76,8 @@
       "output":{"shape":"GetApplicationResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Displays detailed information about a specified application.</p>"
     },
@@ -108,8 +108,8 @@
       "output":{"shape":"GetJobRunResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Displays detailed information about a job run.</p>"
     },
@@ -139,8 +139,8 @@
       "output":{"shape":"ListJobRunAttemptsResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Lists all attempt of a job run.</p>"
     },
@@ -170,8 +170,8 @@
       "output":{"shape":"ListTagsForResourceResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Lists the tags assigned to the resources.</p>"
     },
@@ -186,8 +186,8 @@
       "output":{"shape":"StartApplicationResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
         {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"},
         {"shape":"ServiceQuotaExceededException"}
       ],
       "documentation":"<p>Starts a specified application and initializes initial capacity if configured.</p>",
@@ -222,8 +222,8 @@
       "output":{"shape":"StopApplicationResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Stops a specified application and releases initial capacity if configured. All scheduled and running jobs must be completed or cancelled before stopping an application.</p>",
       "idempotent":true
@@ -239,8 +239,8 @@
       "output":{"shape":"TagResourceResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Assigns tags to resources. A tag is a label that you assign to an Amazon Web Services resource. Each tag consists of a key and an optional value, both of which you define. Tags enable you to categorize your Amazon Web Services resources by attributes such as purpose, owner, or environment. When you have many resources of the same type, you can quickly identify a specific resource based on the tags you've assigned to it. </p>"
     },
@@ -255,8 +255,8 @@
       "output":{"shape":"UntagResourceResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Removes tags from resources.</p>",
       "idempotent":true
@@ -272,8 +272,8 @@
       "output":{"shape":"UpdateApplicationResponse"},
       "errors":[
         {"shape":"ValidationException"},
-        {"shape":"ResourceNotFoundException"},
-        {"shape":"InternalServerException"}
+        {"shape":"InternalServerException"},
+        {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Updates a specified application. An application has to be in a stopped or created state in order to be updated.</p>"
     }
@@ -481,6 +481,12 @@
         "X86_64"
       ]
     },
+    "Arn":{
+      "type":"string",
+      "max":2048,
+      "min":20,
+      "pattern":"([    -~… -퟿-�က0-ჿFF]+)"
+    },
     "AttemptNumber":{
       "type":"integer",
       "box":true,
@@ -1282,6 +1288,20 @@
       "type":"list",
       "member":{"shape":"JobRunAttemptSummary"}
     },
+    "JobRunExecutionIamPolicy":{
+      "type":"structure",
+      "members":{
+        "policy":{
+          "shape":"PolicyDocument",
+          "documentation":"<p>An IAM inline policy to use as an execution IAM policy.</p>"
+        },
+        "policyArns":{
+          "shape":"PolicyArnList",
+          "documentation":"<p>A list of Amazon Resource Names (ARNs) to use as an execution IAM policy.</p>"
+        }
+      },
+      "documentation":"<p>Optional IAM policy. The resulting job IAM role permissions will be an intersection of the policies passed and the policy associated with your job execution role.</p>"
+    },
     "JobRunId":{
       "type":"string",
       "max":64,
@@ -1707,6 +1727,18 @@
       "min":1,
       "pattern":"[A-Za-z0-9_=-]+"
     },
+    "PolicyArnList":{
+      "type":"list",
+      "member":{"shape":"Arn"},
+      "max":10,
+      "min":0
+    },
+    "PolicyDocument":{
+      "type":"string",
+      "max":2048,
+      "min":1,
+      "pattern":"([    -ÿ]+)"
+    },
     "PrometheusMonitoringConfiguration":{
       "type":"structure",
       "members":{
@@ -1925,6 +1957,10 @@
           "shape":"IAMRoleArn",
           "documentation":"<p>The execution role ARN for the job run.</p>"
         },
+        "executionIamPolicy":{
+          "shape":"JobRunExecutionIamPolicy",
+          "documentation":"<p>You can pass an optional IAM policy. The resulting job IAM role permissions will be an intersection of this policy and the policy associated with your job execution role.</p>"
+        },
         "jobDriver":{
           "shape":"JobDriver",
           "documentation":"<p>The job driver for the job run.</p>"