Elastic Compute Service (ECS) application roles allow application processes that run on your E-MapReduce (EMR) cluster to access other Alibaba Cloud services. When you create a cluster, you can use the default ECS application role or a custom role.
Precautions
You cannot change the ECS application role of an EMR cluster after the cluster is created.
Default ECS application role
When you create a cluster in the EMR console, the default ECS application role is used if you do not modify the ECS Application Role parameter in the Advanced Settings section of the Basic Configuration step.
System policies of the default ECS application role are created and maintained by Alibaba Cloud. If service requirements change, the system policies are accordingly updated.
The default ECS application role varies based on the version of EMR on ECS.
In a minor version later than EMR V3.32.0 or V4.5.0 and in EMR 5.X series, the default ECS application role is AliyunECSInstanceForEMRRole. For information about the permissions that are provided by the role, see ECS application role (used in a minor version later than EMR V3.32.0 or EMR V4.5.0 and EMR 5.X series).
In EMR V3.32.0 or an earlier minor version, and in EMR V4.5.0 or an earlier minor version, the default ECS application role is AliyunEmrEcsDefaultRole. For information about the permissions that are provided by the role, see ECS application role (used in EMR V3.32.0 or an earlier minor version, or EMR V4.5.0 or an earlier minor version).
Custom ECS application role
If you want to manage the permissions of the ECS application role, you can configure a custom ECS application role in the Advanced Settings section of the Basic Configuration step when you create an EMR cluster in the EMR console. This way, you can use this role to access other cloud resources, such as Object Storage Service (OSS) and Simple Log Service, in your Alibaba Cloud account in password-free mode. For more information, see Use a custom ECS application role to access other cloud resources in your Alibaba Cloud account.