EMR service roles allow EMR to call other Alibaba Cloud services on your behalf when provisioning cluster resources or performing service-level operations. For example, when you start an EMR cluster, the AliyunEMRDefaultRole service role creates ECS instances automatically. This topic describes the two EMR service roles and their permission policies.
Service roles at a glance
| Service role | Purpose |
|---|---|
| AliyunEMRDefaultRole | Manages cluster infrastructure across ECS, VPC, OSS, Auto Scaling, CloudMonitor, Simple Log Service, ACK, and ApsaraDB RDS |
| AliyunEMRManagedCostRole | Reads billing data to support cost analysis features |
Usage notes
Warning
Do not rename, delete, or modify the system policies of EMR service roles in the RAM console.
Service roles and policies
AliyunEMRDefaultRole
ECS permissions
| Action | Description |
|---|---|
| ecs:CreateInstance | Creates an ECS instance |
| ecs:RunInstances | Creates and starts multiple ECS instances at the same time |
| ecs:RenewInstance | Renews an ECS instance |
| ecs:DescribeRegions | Queries region information |
| ecs:DescribeZones | Queries zone information |
| ecs:DescribeImages | Queries image information |
| ecs:CreateSecurityGroup | Creates a security group |
| ecs:AllocatePublicIpAddress | Assigns a public IP address to an ECS instance |
| ecs:DeleteInstance | Deletes an ECS instance |
| ecs:StartInstance | Starts an ECS instance |
| ecs:StopInstance | Stops an ECS instance |
| ecs:DescribeInstances | Queries ECS instances |
| ecs:DescribeDisks | Queries disk information |
| ecs:AuthorizeSecurityGroup | Configures inbound rules for a security group |
| ecs:AuthorizeSecurityGroupEgress | Configures outbound rules for a security group |
| ecs:DescribeSecurityGroupAttribute | Queries the details of a security group |
| ecs:DescribeSecurityGroups | Queries security groups |
| ecs:DescribeInstanceHistoryEvents | Queries system events of an ECS instance |
| ecs:DescribeInstancesFullStatus | Queries the full status of one or more ECS instances |
| ecs:DescribeDisksFullStatus | Queries the full status of one or more Elastic Block Storage (EBS) devices |
| ecs:ModifyInstanceChargeType | Changes the billing method of one or more ECS instances |
| ecs:ModifyPrepayInstanceSpec | Upgrades the instance type of a subscription ECS instance |
| ecs:DescribeResourcesModification | Queries available resources in a zone when upgrading instance types or replacing system disks |
| ecs:DescribeAvailableResource | Queries resources available in a zone |
| ecs:DescribeBandwidthLimitation | Queries the maximum public bandwidth available for different instance types |
| ecs:CreateNetworkInterface | Creates an elastic network interface (ENI) |
| ecs:DeleteNetworkInterface | Deletes an ENI |
| ecs:DescribeNetworkInterfaces | Queries the details of one or more ENIs |
| ecs:CreateNetworkInterfacePermission | Grants permissions to create an ENI |
| ecs:DescribeNetworkInterfacePermissions | Queries permissions on an ENI |
| ecs:DeleteNetworkInterfacePermission | Grants permissions to delete an ENI |
| ecs:DescribeKeyPairs | Queries one or more key pairs |
| ecs:DescribePrice | Queries the most recent prices of ECS resources |
| ecs:RebootInstance | Restarts an ECS instance in the Running state |
| ecs:AssignIpv6Addresses | Assigns one or more IPv6 addresses to an ENI |
| ecs:AcceptInquiredSystemEvent | Accepts the default operation for a system event in the Inquiring state |
| ecs:RedeployInstance | Redeploys an ECS instance when it receives a system event notification |
| ecs:DescribeTasks | Queries the progress of one or more asynchronous requests of an ECS instance |
| ecs:TagResources | Creates and adds tags to an ECS instance |
| ecs:UntagResources | Removes tags from an ECS instance |
| ecs:ListTagResources | Queries tags added to an ECS instance |
| ecs:JoinResourceGroup | Adds an ECS instance to a resource group |
| ecs:ReportInstancesStatus | Reports an exception on one or more ECS instances |
| ecs:ModifyInstanceAttribute | Modifies the attributes of an ECS instance |
| ecs:DeleteInstances | Releases one or more pay-as-you-go ECS instances |
| ecs:RebootInstances | Restarts one or more ECS instances in the Running state |
| ecs:StartInstances | Starts one or more ECS instances in the Stopped state |
| ecs:StopInstances | Stops one or more ECS instances in the Running state |
| ecs:AttachInstanceRamRole | Attaches an instance RAM role to one or more ECS instances |
| ecs:DescribeLocalDiskRepairActivities | Queries the repair activities of a local disk |
| ecs:CreateAutoProvisioningGroup | Creates an auto provisioning group |
| ecs:DescribeDeploymentSets | Queries the attributes of one or more deployment sets |
| ecs:ResizeDisk | Resizes a disk |
OSS permissions
| Action | Description |
|---|---|
| oss:PutObject | Uploads a file or folder |
| oss:GetObject | Retrieves a file or folder |
| oss:ListObjects | Lists all objects in a bucket |
VPC permissions
| Action | Description |
|---|---|
| vpc:DescribeVSwitches | Queries vSwitches in a VPC |
| vpc:DescribeVpcs | Queries VPC details |
| vpc:AllocateEipAddress | Applies for an elastic IP address (EIP) |
| vpc:AssociateEipAddress | Associates an EIP with a cloud resource in the same region |
| vpc:UnassociateEipAddress | Disassociates an EIP from a cloud resource |
| vpc:ReleaseEipAddress | Releases an EIP |
| vpc:DescribeEipAddresses | Queries EIPs in a region |
CloudMonitor permissions
| Action | Description |
|---|---|
| cms:CreateAlarm | Creates an event-triggered task |
| cms:DeleteAlarm | Deletes an event-triggered task |
| cms:QueryAlarm | Queries an alert |
| cms:QueryMetricList | Queries monitoring data for an instance over a specified period |
| cms:CreateAlert | Creates an alert |
| cms:CreateDimensions | Creates monitoring metric configurations |
| cms:DeleteAlert | Deletes an alert |
| cms:DisableAlarm | Disables an event-triggered task |
| cms:UpdateAlarm | Updates an alert |
| cms:ListAlarmHistory | Queries the history of a specified alert rule or all alert rules |
| cms:DescribeMonitorGroups | Queries application groups |
| cms:CreateMonitorGroup | Creates an application group |
| cms:DeleteMonitorGroup | Deletes an application group |
| cms:ApplyMetricRuleTemplate | Applies an alert template to an application group to generate an alert rule |
| cms:ModifyMonitorGroupInstances | Updates the resources in an application group |
| cms:DescribeMetricRuleTemplateList | Queries alert templates |
| cms:CreateMonitoringTemplate | Creates a monitoring template |
| cms:DescribeEventRuleList | Queries event-triggered alert rules |
| cms:DescribeMetricRuleList | Queries alert rules |
Auto Scaling permissions
| Action | Description |
|---|---|
| ess:CreateScalingGroup | Creates a scaling group |
| ess:ModifyScalingGroup | Modifies a scaling group |
| ess:EnableScalingGroup | Enables a scaling group |
| ess:DisableScalingGroup | Disables a scaling group |
| ess:DeleteScalingGroup | Deletes a scaling group |
| ess:DescribeScalingGroups | Queries scaling groups |
| ess:DescribeScalingInstances | Queries ECS instances in a scaling group |
| ess:DescribeScalingActivities | Queries scaling activities |
| ess:CreateScalingConfiguration | Creates a scaling configuration |
| ess:DescribeScalingConfigurations | Queries scaling configurations |
| ess:DeleteScalingConfiguration | Deletes a scaling configuration |
| ess:CreateScalingRule | Creates a scaling rule |
| ess:ModifyScalingRule | Modifies a scaling rule |
| ess:DescribeScalingRules | Queries scaling rules in a scaling group |
| ess:DeleteScalingRule | Deletes a scaling rule |
| ess:CreateScheduledTask | Creates a scheduled task |
| ess:ModifyScheduledTask | Modifies a scheduled task |
| ess:DescribeScheduledTasks | Queries scheduled tasks |
| ess:DeleteScheduledTask | Deletes a scheduled task |
| ess:RemoveInstances | Removes one or more ECS instances from a scaling group |
| ess:CreateLifecycleHook | Creates one or more lifecycle hooks for a scaling group |
| ess:DescribeLifecycleHooks | Queries lifecycle hooks |
| ess:ModifyLifecycleHook | Modifies a lifecycle hook |
| ess:DeleteLifecycleHook | Deletes a lifecycle hook |
| ess:CompleteLifecycleAction | Ends the wait state of a scaling activity early |
| ess:RecordLifecycleActionHeartbeat | Extends the timeout period of a lifecycle hook for an ECS instance |
| ess:CreateNotificationConfiguration | Creates a notification for scaling activities and resource changes |
| ess:DescribeNotificationConfigurations | Queries notifications for scaling activities and resource changes |
| ess:DescribeRegions | Queries the regions where Auto Scaling is available |
| ess:SetInstancesProtection | Enables or disables protection for one or more ECS instances in a scaling group |
| ess:ExecuteScalingRule | Executes a scaling rule |
| ess:DetachInstances | Detaches one or more ECS instances from a scaling group |
| ess:ModifyScalingConfiguration | Modifies a scaling configuration |
| ess:DescribeScalingActivityDetail | Queries the details of a scaling activity |
| ess:ScaleWithAdjustment | Scales instances in a scaling group based on a specified scaling policy |
RAM permissions
| Action | Description |
|---|---|
| ram:GetUser | Queries information about a RAM user |
| ram:GetRole | Queries information about a RAM role |
Simple Log Service permissions
| Action | Description |
|---|---|
| log:ListProject | Queries projects matching specified conditions |
| log:GetProject | Queries the details of a project |
| log:CreateProject | Creates a project |
| log:GetLogStore | Queries the details of a Logstore |
| log:CreateLogStore | Creates a Logstore |
| log:GetConfig | Queries the details of a Logtail configuration file |
| log:CreateConfig | Creates a Logtail configuration file |
| log:GetIndex | Queries the indexes of a Logstore |
| log:CreateIndex | Creates indexes for a Logstore |
| log:GetAppliedMachineGroups | Queries the machine groups that a Logtail configuration file is applied to |
| log:ApplyConfigToMachineGroup | Applies a Logtail configuration file to a machine group |
| log:ApplyConfigToGroup | Applies a Logtail configuration file to a machine group |
ACK permissions
| Action | Description |
|---|---|
| cs:CreateCluster | Creates a Container Service for Kubernetes (ACK) cluster |
| cs:GetClusters | Queries the details of all ACK clusters |
| cs:AttachInstances | Adds existing ECS instances to an ACK cluster |
Managed Service for Prometheus permissions
| Action | Description |
|---|---|
| arms:AddIntegration | Integrates the dashboard and collection rules of Managed Service for Prometheus |
| arms:AddGrafana | Integrates the dashboard of Managed Service for Prometheus |
| arms:ListDashboards | Queries the Grafana dashboards of an ACK cluster |
| arms:GetPrometheusApiToken | Retrieves the token required for integrating Managed Service for Prometheus |
ApsaraDB RDS permissions
| Action | Description |
|---|---|
| rds:DescribeDBInstances | Queries ApsaraDB RDS instances matching specified conditions, or instances a RAM user has permissions to |
| rds:DescribeDBInstanceAttribute | Queries the details of one or more ApsaraDB RDS instances |
| rds:DescribeDatabase | Queries the details of databases on an ApsaraDB RDS instance |
Quota and KMS permissions
| Action | Description |
|---|---|
| quotas:ListProductQuotas | Queries ECS quotas |
| kms:ListKeys | Lists all customer master keys (CMKs) in the current Alibaba Cloud account |
AliyunEMRManagedCostRole
| Action | Description |
|---|---|
| bssapi:DescribeInstanceBill | Queries bill details from the billing management center |