full_studio_dependencies.yml [177:540]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EMRStudioUserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EMRStudio_User_Role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "User role for EMR Studio"

  EMRStudioBasicUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: EMRStudio_Basic_User_Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  


  EMRStudioIntermediateUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: EMRStudio_Intermediate_User_Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
        - Sid: AllowClusterTemplatesRelatedIntermediateActions
          Effect: Allow
          Resource: "*"
          Action:
          - "servicecatalog:DescribeProduct"
          - "servicecatalog:DescribeProductView"
          - "servicecatalog:ListLaunchPaths"
          - "servicecatalog:DescribeProvisioningParameters"
          - "servicecatalog:ProvisionProduct"
          - "servicecatalog:SearchProducts"
          - "servicecatalog:ListProvisioningArtifacts"
          - "servicecatalog:DescribeRecord"
          - "cloudformation:DescribeStackResources"


  EMRStudioAdvancedUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: EMRStudio_Advanced_User_Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_DefaultRole
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_EC2_DefaultRole
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
        - Sid: AllowClusterTemplatesRelatedIntermediateActions
          Effect: Allow
          Resource: "*"
          Action:
          - "servicecatalog:DescribeProduct"
          - "servicecatalog:DescribeProductView"
          - "servicecatalog:ListLaunchPaths"
          - "servicecatalog:DescribeProvisioningParameters"
          - "servicecatalog:ProvisionProduct"
          - "servicecatalog:SearchProducts"
          - "servicecatalog:ListProvisioningArtifacts"
          - "servicecatalog:DescribeRecord"
          - "cloudformation:DescribeStackResources"
        - Sid: AllowAdvancedActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:RunJobFlow"



  # Security Groups
  WorkspaceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata: {Comment: 'Security group attached to workspace'}
    Properties:
      GroupName: WorkspaceSecurityGroup
      GroupDescription: Security group attached to workspace to communicate with cluster
      VpcId:
        Ref: VPC
      # needed for git
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: "0.0.0.0/0"
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true

  EngineSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata: {Comment: 'Security group attached to cluster master instance'}
    Properties:
      GroupDescription: Security group attached to cluster master to communicate with workspace
      GroupName: EngineSecurityGroup
      VpcId:
        Ref: VPC
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true

  EngineSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allow inbound traffic to EngineSecurityGroup ( from notebook to cluster for port 18888 )
      GroupId:
        Ref: EngineSecurityGroup
      SourceSecurityGroupId:
        Ref: WorkspaceSecurityGroup
      IpProtocol: tcp
      FromPort: 18888
      ToPort: 18888

  WorkspaceSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: Allow outbound traffic from WorkspaceSecurityGroup ( from notebook to cluster for port 18888 )
      GroupId:
        Ref: WorkspaceSecurityGroup
      DestinationSecurityGroupId:
        Ref: EngineSecurityGroup
      IpProtocol: tcp
      FromPort: 18888
      ToPort: 18888
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



min_studio_dependencies.yml [164:527]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EMRStudioUserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EMRStudio_User_Role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "User role for EMR Studio"

  EMRStudioBasicUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: EMRStudio_Basic_User_Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  


  EMRStudioIntermediateUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: EMRStudio_Intermediate_User_Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
        - Sid: AllowClusterTemplatesRelatedIntermediateActions
          Effect: Allow
          Resource: "*"
          Action:
          - "servicecatalog:DescribeProduct"
          - "servicecatalog:DescribeProductView"
          - "servicecatalog:ListLaunchPaths"
          - "servicecatalog:DescribeProvisioningParameters"
          - "servicecatalog:ProvisionProduct"
          - "servicecatalog:SearchProducts"
          - "servicecatalog:ListProvisioningArtifacts"
          - "servicecatalog:DescribeRecord"
          - "cloudformation:DescribeStackResources"


  EMRStudioAdvancedUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: EMRStudio_Advanced_User_Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_DefaultRole
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_EC2_DefaultRole
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
        - Sid: AllowClusterTemplatesRelatedIntermediateActions
          Effect: Allow
          Resource: "*"
          Action:
          - "servicecatalog:DescribeProduct"
          - "servicecatalog:DescribeProductView"
          - "servicecatalog:ListLaunchPaths"
          - "servicecatalog:DescribeProvisioningParameters"
          - "servicecatalog:ProvisionProduct"
          - "servicecatalog:SearchProducts"
          - "servicecatalog:ListProvisioningArtifacts"
          - "servicecatalog:DescribeRecord"
          - "cloudformation:DescribeStackResources"
        - Sid: AllowAdvancedActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:RunJobFlow"



  # Security Groups
  WorkspaceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata: {Comment: 'Security group attached to workspace'}
    Properties:
      GroupName: WorkspaceSecurityGroup
      GroupDescription: Security group attached to workspace to communicate with cluster
      VpcId:
        Ref: VPC
      # needed for git
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: "0.0.0.0/0"
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true

  EngineSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata: {Comment: 'Security group attached to cluster master instance'}
    Properties:
      GroupDescription: Security group attached to cluster master to communicate with workspace
      GroupName: EngineSecurityGroup
      VpcId:
        Ref: VPC
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true

  EngineSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allow inbound traffic to EngineSecurityGroup ( from notebook to cluster for port 18888 )
      GroupId:
        Ref: EngineSecurityGroup
      SourceSecurityGroupId:
        Ref: WorkspaceSecurityGroup
      IpProtocol: tcp
      FromPort: 18888
      ToPort: 18888

  WorkspaceSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: Allow outbound traffic from WorkspaceSecurityGroup ( from notebook to cluster for port 18888 )
      GroupId:
        Ref: WorkspaceSecurityGroup
      DestinationSecurityGroupId:
        Ref: EngineSecurityGroup
      IpProtocol: tcp
      FromPort: 18888
      ToPort: 18888
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



