In V3.X.X versions later than E-MapReduce (EMR) V3.32.0 as well as in V4.X.X versions later than EMR V4.5.0, MetaService is replaced with the ECS application role AliyunECSInstanceForEMRRole. This role is automatically assigned to each ECS instance in your EMR cluster when you create or scale out the cluster. Applications that run on your EMR cluster use this role to access other Alibaba Cloud resources without an AccessKey pair. This avoids the disclosure of the AccessKey pair in a configuration file.


This role is authorized. For more information, see Authorize roles.


The role AliyunECSInstanceForEMRRole is configured with the policy AliyunECSInstanceForEMRRolePolicy. The following table describes OSS-related permissions of this role.
Permission (Action) Description
oss:PutObject Uploads a file or folder.
oss:GetObject Obtains a file or folder.
oss:ListObjects Queries files.
oss:DeleteObject Deletes a file.
oss:AbortMultipartUpload Terminates a multipart upload event.
Notice Modify or delete the AliyunEmrEcsDefaultRole role with caution. Otherwise, your cluster fails to be created or jobs fail to be run.

Use the ECS application role to obtain an STS temporary credential

You can use a Security Token Service (STS) temporary credential to access other Alibaba Cloud services within your account. For more information, see Use RAM roles to access other Alibaba Cloud services.