Before you create an E-MapReduce (EMR) cluster, grant EMR the default RAM roles it needs to access Elastic Compute Service (ECS) and other Alibaba Cloud services. This is a one-time setup — once the roles are assigned, all Alibaba Cloud account users and RAM users in your account can use EMR without repeating this step.
Default roles
EMR requires the following RAM roles. Assign all of them before creating your first cluster.
| Role | Description | Required for | System policy |
|---|---|---|---|
| AliyunEMRDefaultRole | EMR service role. Allows EMR to access other Alibaba Cloud services when provisioning resources and performing service-level operations on your cluster. | All clusters. Cannot be changed. | AliyunEMRRolePolicy |
| AliyunECSInstanceForEMRRole | ECS application role for clusters running a minor version later than EMR V3.32.0 or V4.5.0. Allows application processes on your cluster to access other Alibaba Cloud services. | Clusters running EMR later than V3.32.0 or V4.5.0. Can be replaced with a custom role. | AliyunECSInstanceForEMRRolePolicy |
| AliyunEmrEcsDefaultRole | ECS application role for clusters running EMR V3.32.0 or earlier minor versions, or V4.5.0 or earlier minor versions. Allows application processes on your cluster to access other Alibaba Cloud services. | Clusters running EMR V3.32.0 or V4.5.0 and earlier. Can be replaced with a custom role. | AliyunEMRECSRolePolicy |
| AliyunEMRManagedCostRole | Allows EMR to view bill details on the billing management page. | Required only when using the auto scaling cost analysis feature for the first time. | AliyunEMRManagedCostRolePolicy |
| AliyunECSInstanceForEMRStudioRole | Allows EMR Studio to access resources in other Alibaba Cloud services. To assign this role, you must use your Alibaba Cloud account. | Required only when creating an EMR Studio cluster for the first time. | AliyunECSInstanceForEMRStudioRolePolicy |
System policies are created and maintained by Alibaba Cloud and are updated automatically when service requirements change. After assignment, you can view roles and attach additional policies in the RAM console. For background on RAM roles, see RAM role overview.
Prerequisites
Before you begin, make sure that you have:
-
An Alibaba Cloud account or a RAM user account with the required permissions
-
Not yet created an EMR cluster — this step is only needed the first time you use EMR
Authorize EMR roles
-
Log on to the EMR console using your Alibaba Cloud account.
-
Go to the Dependency Check page, find the check item for the role, and click Authorize Now in the Actions column.
-
On the Cloud Resource Access Authorization page, click Agree to Authorization at the bottom of the page.
-
On the Users page of the RAM console, confirm that the roles are created.
If only some roles are assigned, the EMR console displays a notification. You cannot create a cluster until all required roles are assigned.
FAQ
What happens if I delete a role after cluster creation?
The cluster fails when it tries to use the deleted role. Before deleting any service role, release all resources that depend on it.
What's next
With roles assigned, create your first EMR cluster. See Create a cluster.
For team environments, manage EMR through RAM users rather than the root Alibaba Cloud account. See Create a RAM user and Grant permissions to RAM users.