When the built-in system policies of E-MapReduce (EMR) are too broad for your needs, create custom Resource Access Management (RAM) policies to enforce the principle of least privilege. Custom policies enable fine-grained permission management, giving you precise control over which principals can access which EMR resources and operations, and improve resource access security.
What is a custom policy?
RAM policies fall into two categories:
| Type | Managed by | Scope |
|---|---|---|
| System policy | Alibaba Cloud | Predefined for general use; may grant broader permissions than your workload requires |
| Custom policy | You | Scoped exactly to your business requirements |
After creating a custom policy, attach it to a RAM user, RAM user group, or RAM role. The permissions defined in the policy are then granted to that principal.
Policy lifecycle
| Operation | Description |
|---|---|
| Create | Define permissions based on the actions and resources your principals need |
| Attach | Attach the policy to one or more RAM users, RAM user groups, or RAM roles |
| Update | Modify the policy document or description as requirements change. Custom policies support version control via RAM's version management mechanism |
| Delete | Detach the policy from all principals before deleting it. Policies with no attached principals can be deleted directly |
| Manage versions | Manage custom policy versions using RAM's version management mechanism |
Authorization information
The actions and resources available for custom policies differ between EMR deployment types. Before writing policy documents, review the RAM authorization reference for your deployment:
-
EMR on ECS: RAM authorization
-
EMR Serverless Spark: RAM authorization