full_studio_dependencies.yml [24:172]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EMRStudioServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "Service role for EMR Studio"
      RoleName: EMRStudio_Service_Role

  EMRStudioServiceRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: EMRStudioServiceRolePolicy
      Roles:
      - !Ref EMRStudioServiceRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowEMRReadOnlyActions
            Effect: Allow
            Action:
              - elasticmapreduce:ListInstances
              - elasticmapreduce:DescribeCluster
              - elasticmapreduce:ListSteps
            Resource: '*'

          - Sid: AllowEC2ENIActionsWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterfacePermission
              - ec2:DeleteNetworkInterface
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowEC2ENIAttributeAction
            Effect: Allow
            Action:
              - ec2:ModifyNetworkInterfaceAttribute
            Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:instance/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'

          - Sid: AllowEC2SecurityGroupActionsWithEMRTags
            Effect: Allow
            Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupEgress
              - ec2:RevokeSecurityGroupIngress
              - ec2:DeleteNetworkInterfacePermission
            Resource: '*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowDefaultEC2SecurityGroupsCreationWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:vpc/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowAddingEMRTagsDuringDefaultSecurityGroupCreation
            Effect: Allow
            Action:
              - ec2:CreateTags
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
                "ec2:CreateAction": "CreateSecurityGroup"

          - Sid: AllowEC2ENICreationWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterface
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowEC2ENICreationInSubnetAndSecurityGroupWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterface
            Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:subnet/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowAddingTagsDuringEC2ENICreation
            Effect: Allow
            Action:
              - ec2:CreateTags
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "ec2:CreateAction": "CreateNetworkInterface"

          - Sid: AllowEC2ReadOnlyActions
            Effect: Allow
            Action:
              - ec2:DescribeSecurityGroups
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeTags
              - ec2:DescribeInstances
              - ec2:DescribeSubnets
              - ec2:DescribeVpcs
            Resource: '*'

          - Sid: AllowSecretsManagerReadOnlyActionsWithEMRTags
            Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource: !Sub 'arn:${AWS::Partition}:secretsmanager:*:*:secret:*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: S3permission
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:GetEncryptionConfiguration
              - s3:ListBucket
              - s3:DeleteObject
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



min_studio_dependencies.yml [12:161]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EMRStudioServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "Service role for EMR Studio"
      RoleName: EMRStudio_Service_Role


  EMRStudioServiceRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: EMRStudioServiceRolePolicy
      Roles:
      - !Ref EMRStudioServiceRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowEMRReadOnlyActions
            Effect: Allow
            Action:
              - elasticmapreduce:ListInstances
              - elasticmapreduce:DescribeCluster
              - elasticmapreduce:ListSteps
            Resource: '*'

          - Sid: AllowEC2ENIActionsWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterfacePermission
              - ec2:DeleteNetworkInterface
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowEC2ENIAttributeAction
            Effect: Allow
            Action:
              - ec2:ModifyNetworkInterfaceAttribute
            Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:instance/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'

          - Sid: AllowEC2SecurityGroupActionsWithEMRTags
            Effect: Allow
            Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupEgress
              - ec2:RevokeSecurityGroupIngress
              - ec2:DeleteNetworkInterfacePermission
            Resource: '*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowDefaultEC2SecurityGroupsCreationWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:vpc/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowAddingEMRTagsDuringDefaultSecurityGroupCreation
            Effect: Allow
            Action:
              - ec2:CreateTags
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
                "ec2:CreateAction": "CreateSecurityGroup"

          - Sid: AllowEC2ENICreationWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterface
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowEC2ENICreationInSubnetAndSecurityGroupWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterface
            Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:subnet/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowAddingTagsDuringEC2ENICreation
            Effect: Allow
            Action:
              - ec2:CreateTags
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "ec2:CreateAction": "CreateNetworkInterface"

          - Sid: AllowEC2ReadOnlyActions
            Effect: Allow
            Action:
              - ec2:DescribeSecurityGroups
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeTags
              - ec2:DescribeInstances
              - ec2:DescribeSubnets
              - ec2:DescribeVpcs
            Resource: '*'

          - Sid: AllowSecretsManagerReadOnlyActionsWithEMRTags
            Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource: !Sub 'arn:${AWS::Partition}:secretsmanager:*:*:secret:*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: S3permission
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:GetEncryptionConfiguration
              - s3:ListBucket
              - s3:DeleteObject
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



