full_studio_dependencies.yml [198:276]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



full_studio_dependencies.yml [285:363]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



