Alibaba Cloud E-MapReduce (EMR on ECS) requires permission to access other Alibaba Cloud resources and act on your behalf. This topic explains the one-time authorization process, which lets E-MapReduce automatically create its required default roles when you first use the service.
Background
Alibaba Cloud E-MapReduce provides default roles and default policies for your Alibaba Cloud account. The policies are created and maintained by Alibaba Cloud and are automatically updated if service requirements change.
After authorization is successful, you can view the roles and their attached policies in the RAM console. For more information about roles, see RAM role overview.
The names of the service roles that require authorization vary based on the E-MapReduce version:
For EMR 3.32.0 and earlier, and EMR 4.5.0 and earlier:
AliyunEmrEcsDefaultRoleFor versions later than EMR 3.32.0 and EMR 4.5.0:
AliyunECSInstanceForEMRRole
When you use the E-MapReduce service for the first time, you must use an Alibaba Cloud account or a RAM user with administrative permissions to complete the default role authorization. Otherwise, no one in your account, including RAM users, can use the E-MapReduce service.
If you delete a service role, first release any resources that use it.
If you authorize only some of the required roles, the E-MapReduce console prompts you to complete the authorization. You can create a cluster only after you authorize all required roles.
Procedure
Log in to the E-MapReduce console with your Alibaba Cloud account.
On the Dependency Check page, click Authorize Now.
On the Cloud Resource Access Authorization page, click Authorize.
In the RAM console, view the newly created roles.
After the authorization is complete, on the Roles page (RAM console > Identities > Roles), you can find two automatically created roles that allow access to other Alibaba Cloud services: AliyunECSInstanceForEMRRole for E-MapReduce jobs, and AliyunEMRDefaultRole for the E-MapReduce service itself.
Default roles
The following table describes the default roles associated with E-MapReduce and their related policies.
Attribute | Default role | Description | System policy |
EMR service role | AliyunEMRDefaultRole | Allows E-MapReduce to call other Alibaba Cloud services when provisioning resources and performing service-level operations. This role is required for all clusters and cannot be changed. For more information, see EMR service role. | AliyunEMRRolePolicy |
AliyunEMRManagedCostRole | This role is required the first time you use the auto scaling cost analysis feature. This role allows you to view the bill details in billing management. | AliyunEMRManagedCostRolePolicy | |
ECS application role (for EMR 3.32.0 and earlier, and EMR 4.5.0 and earlier) | AliyunEmrEcsDefaultRole | Application processes that run on cluster instances use this role to call other Alibaba Cloud services. When you create a cluster, you can use either this service role or a custom role. For more information about the AliyunEmrEcsDefaultRole role, see ECS application role (for EMR 3.32 and earlier, and EMR 4.5 and earlier). | AliyunEMRECSRolePolicy |
ECS application role (for versions later than EMR 3.32.0 and EMR 4.5.0) | AliyunECSInstanceForEMRRole | Application processes that run on cluster instances use this role to call other Alibaba Cloud services. When you create a cluster, you can use either this service role or a custom role. For more information about the AliyunECSInstanceForEMRRole role, see ECS application role (for versions later than EMR 3.32 and EMR 4.5, and for the EMR 5.x series). | AliyunECSInstanceForEMRRolePolicy |
ECS application role (default for EMR Studio) | AliyunECSInstanceForEMRStudioRole | EMR Studio uses this role to access your resources in other Alibaba Cloud services. If this role is not yet authorized for your account, you are prompted to authorize it with your Alibaba Cloud account when creating your first EMR Studio cluster. | AliyunECSInstanceForEMRStudioRolePolicy |
What to do next
After you authorize the required roles, you can create a cluster and start using the E-MapReduce service. For more information, see Create a cluster. We recommend that you create RAM users to manage the E-MapReduce service. To create a RAM user for collaborative development and assign the required permissions, see Create a RAM user and Grant permissions to a RAM user.