Not able to bring up EMR EC2 instance

Question

I am trying to create a EMR cluster with version 6.13.0 and spark installed on it with version Spark 3.4.1 But the service role attached gives error that it does not have  EC2 permissions. 
I tried with providing full EC2 access to the service role as well.

I than used the create service role option which created a new  service role with default VPC , subnet and security group. But still i get the same validation error.
The default role had below policies attached.
1.  AmazonEMRServicePolicy_v2
2.  AmazonEMR-ServiceRole-Policy-20231116T130134

I manually attached "AmazonEC2FullAccess" as well  but the error still comes.

"Service role arn:aws:iam: xxxxx/role/service-role/AmazonEMR-ServiceRole-20231116T130134 has insufficient EC2 permissions"

Kindly suggest what I am doing wrong.

Answer

Hi,
As you have seen it, when choosing the “create service role option”, Amazon EMR automatically attaches two mentioned policies by default, encompassing permissions for EC2, CloudWatch, IAM, and more.  However, encountering this error message might be from conflicting policies or overrides within your IAM settings for roles or users.
To diagnose this issue, you can leverage, AWS CloudTrail logs to trace API calls directed to EMR. By analyzing these logs, you can pinpoint denied actions and uncover the root cause of conflicting permissions. Ensure that the role attached to your user account has sufficient permissions to create clusters and EC2 instances.
Additionally, confirm the selection of the correct EC2 instance profile. This profile, a specific type of service role, is assigned to every EC2 instance in an Amazon EMR cluster upon when it is created. Ensuring the appropriate configuration of both user roles and instance profiles can help troubleshoot permission-related issues encountered. For more information please refer  [EC2 instance profile ](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-role-for-ec2.html) and [Service role for Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-role.html) links

Answer

Hello,

If you have provided appropriate EC2 permissions, still the service role assume trust policy of elasticmapreduce.amazonaws.com.  You can try using EMR_DefaultRole service role which is default role available to test if it is working or not. Alternatively you can create the policy with below json for an instance and then trust relationships should add the trust policy as shown below,

Example EMR role:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": "*",
            "Action": [
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CancelSpotInstanceRequests",
                "ec2:CreateFleet",
                "ec2:CreateLaunchTemplate",
                "ec2:CreateNetworkInterface",
                "ec2:CreateSecurityGroup",
                "ec2:CreateTags",
                "ec2:DeleteLaunchTemplate",
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteTags",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeLaunchTemplates",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribePrefixLists",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSpotInstanceRequests",
                "ec2:DescribeSpotPriceHistory",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcEndpointServices",
                "ec2:DescribeVpcs",
                "ec2:DetachNetworkInterface",
                "ec2:ModifyImageAttribute",
                "ec2:ModifyInstanceAttribute",
                "ec2:RequestSpotInstances",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "ec2:DeleteVolume",
                "ec2:DescribeVolumeStatus",
                "ec2:DescribeVolumes",
                "ec2:DetachVolume",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListInstanceProfiles",
                "iam:ListRolePolicies",
                "iam:PassRole",
                "s3:CreateBucket",
                "s3:Get*",
                "s3:List*",
                "sdb:BatchPutAttributes",
                "sdb:Select",
                "sqs:CreateQueue",
                "sqs:Delete*",
                "sqs:GetQueue*",
                "sqs:PurgeQueue",
                "sqs:ReceiveMessage",
                "cloudwatch:PutMetricAlarm",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DeleteAlarms",
                "application-autoscaling:RegisterScalableTarget",
                "application-autoscaling:DeregisterScalableTarget",
                "application-autoscaling:PutScalingPolicy",
                "application-autoscaling:DeleteScalingPolicy",
                "application-autoscaling:Describe*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot*",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "spot.amazonaws.com"
                }
            }
        }
    ]
}
```

Example Trust policy:

```
{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "elasticmapreduce.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

You can test the custom IAM policy using IAM Simulator. More information here - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

Answer

Amazon EMR uses an IAM service role to perform actions on your behalf to provision and manage clusters. The service role for cluster EC2 instances, also called the EC2 instance profile for Amazon EMR, is a special type of service role assigned to every EC2 instance in a cluster at launch.
Define a custom EC2 instance profile to use instead of the EMR_EC2_DefaultRole when you launch your cluster.

Not able to bring up EMR EC2 instance

Relevant content