View a markdown version of this page

Amazon EMR on EKS examples using AWS CLI - AWS SDK Code Examples
Actions

There are more AWS SDK examples available in the AWS Doc SDK Examples GitHub repo.

Amazon EMR on EKS examples using AWS CLI

The following code examples show you how to perform actions and implement common scenarios by using the AWS Command Line Interface with Amazon EMR on EKS.

Actions are code excerpts from larger programs and must be run in context. While actions show you how to call individual service functions, you can see actions in context in their related scenarios.

Each example includes a link to the complete source code, where you can find instructions on how to set up and run the code in context.

Topics

Actions

The following code example shows how to use create-role-associations.

AWS CLI

To create role associations of an IAM Role with EMR service accounts to be used with Amazon EMR on EKS

The following create-role-associations example creates EKS pod identity associations of a role named example_iam_role with EMR service accounts such that it can be used with Amazon EMR on EKS with example_namespace namespace from an EKS cluster named example_cluster.

aws emr-containers create-role-associations \
    --cluster-name example_cluster \
    --namespace example_namespace \
    --role-name example_iam_role

Output:

[
    {
        "clusterName": "example_cluster",
        "namespace": "example_namespace",
        "serviceAccount": "emr-spark-client-service-account-example",
        "roleArn": "arn:aws:iam::123456789012:role/example_iam_role",
        "associationArn": "arn:aws:eks:us-west-2:123456789012:podidentityassociation/example_cluster/a-bgyr1umgdmrk1kdtq",
        "associationId": "a-bgyr1umgdmrk1kdtq",
        "tags": {},
        "createdAt": "2022-11-15T10:49:00+00:00",
        "modifiedAt": "2022-11-15T10:49:00+00:00"
    },
    {
        "clusterName": "example_cluster",
        "namespace": "example_namespace",
        "serviceAccount": "emr-spark-driver-service-account-example",
        "roleArn": "arn:aws:iam::123456789012:role/example_iam_role",
        "associationArn": "arn:aws:eks:us-west-2:123456789012:podidentityassociation/example_cluster/b-bgyr1umgdmrk1kdtq",
        "associationId": "b-bgyr1umgdmrk1kdtq",
        "tags": {},
        "createdAt": "2022-11-15T10:49:00+00:00",
        "modifiedAt": "2022-11-15T10:49:00+00:00"
    },
    {
        "clusterName": "example_cluster",
        "namespace": "example_namespace",
        "serviceAccount": "emr-spark-executor-service-account-example",
        "roleArn": "arn:aws:iam::123456789012:role/example_iam_role",
        "associationArn": "arn:aws:eks:us-west-2:123456789012:podidentityassociation/example_cluster/c-bgyr1umgdmrk1kdtq",
        "associationId": "c-bgyr1umgdmrk1kdtq",
        "tags": {},
        "createdAt": "2022-11-15T10:49:00+00:00",
        "modifiedAt": "2022-11-15T10:49:00+00:00"
    }
]

For more information, see Option 1: Enable EKS Pod Identity on the EKS Cluster in the Amazon EMR on EKS Development Guide.

The following code example shows how to use delete-role-associations.

AWS CLI

To delete role associations of an IAM Role with EMR service accounts

The following delete-role-associations example deletes EKS pod identity associations of a role named example_iam_role with EMR service accounts such that it can be removed from Amazon EMR on EKS with example_namespace namespace from an EKS cluster named example_cluster.

EKS allows associations with non existing resources (namespace, service account), so EMR on EKS suggest to delete the associations if the namespace is deleted or the role is not in use to release the space for other associations.

aws emr-containers delete-role-associations \
    --cluster-name example_cluster \
    --namespace example_namespace \
    --role-name example_iam_role

Output:

[
    {
        "clusterName": "example_cluster",
        "namespace": "example_namespace",
        "serviceAccount": "emr-spark-client-service-account-example",
        "roleArn": "arn:aws:iam::123456789012:role/example_iam_role",
        "associationArn": "arn:aws:eks:us-west-2:123456789012:podidentityassociation/example_cluster/a-bgyr1umgdmrk1kdtq",
        "associationId": "a-bgyr1umgdmrk1kdtq",
        "tags": {},
        "createdAt": "2022-11-15T10:49:00+00:00",
        "modifiedAt": "2022-11-15T10:49:00+00:00"
    },
    {
        "clusterName": "example_cluster",
        "namespace": "example_namespace",
        "serviceAccount": "emr-spark-driver-service-account-example",
        "roleArn": "arn:aws:iam::123456789012:role/example_iam_role",
        "associationArn": "arn:aws:eks:us-west-2:123456789012:podidentityassociation/example_cluster/b-bgyr1umgdmrk1kdtq",
        "associationId": "b-bgyr1umgdmrk1kdtq",
        "tags": {},
        "createdAt": "2022-11-15T10:49:00+00:00",
        "modifiedAt": "2022-11-15T10:49:00+00:00"
    },
    {
        "clusterName": "example_cluster",
        "namespace": "example_namespace",
        "serviceAccount": "emr-spark-executor-service-account-example",
        "roleArn": "arn:aws:iam::123456789012:role/example_iam_role",
        "associationArn": "arn:aws:eks:us-west-2:123456789012:podidentityassociation/example_cluster/c-bgyr1umgdmrk1kdtq",
        "associationId": "c-bgyr1umgdmrk1kdtq",
        "tags": {},
        "createdAt": "2022-11-15T10:49:00+00:00",
        "modifiedAt": "2022-11-15T10:49:00+00:00"
    }
]

For more information, see Option 1: Enable EKS Pod Identity on the EKS Cluster in the Amazon EMR on EKS Development Guide.

The following code example shows how to use update-role-trust-policy.

AWS CLI

To update the trust policy of an IAM Role to be used with Amazon EMR on EKS

The following update-role-trust-policy example updates the trust policy of a role named example_iam_role such that it can be used with Amazon EMR on EKS with example_namespace namespace from an EKS cluster named example_cluster.

aws emr-containers update-role-trust-policy \
    --cluster example_cluster \
    --namespace example_namespace \
    --role-name example_iam_role

If the trust policy has already been updated, the command displays the following output.

Output:

Trust policy statement already exists for role example_iam_role. No changes were made!

If the trust policy has not been updated yet, the command displays the following output.

Output:

Successfully updated trust policy of role example_iam_role.

For more information, see Update the trust policy of the job execution role in the Amazon EMR on EKS Development Guide.