Adding an existing Amazon EMR on EC2 cluster in Amazon SageMaker Unified Studio

1. The Amazon SageMaker Unified Studio admin must configure the tooling configurations in the blueprints for a project profile so that allowConnectionToUserGovernedEmrClusters is set to True in the Amazon SageMaker Unified Studio management console. For more information, see the Amazon SageMaker Unified Studio Administrator Guide.

2. You create a project using the project profile that your admin modified in step 1.

Create an Amazon EMR access role with a trust policy

1. Get the project role ARN and project ID for the Amazon SageMaker Unified Studio project that you want to grant access to. Project members can get the project role ARN and project ID from the Project overview page in their project.

   Note

   If the Amazon SageMaker Unified Studio project uses a different VPC than the Amazon EMR on EC2 cluster you want to grant access to, you must also get the project VPC information from the project member and complete additional steps to connect the VPCs. For more information, see VPC to VPC connectivity and Connect VPCs using VPC peering.

2. Make sure that the EMR cluster you want to grant access to has an instance profile role with the sts:AssumeRole permission on the runtime role. For more information, see Runtime roles for Amazon EMR steps in the Amazon EMR Management Guide.

3. Go to the AWS IAM console.

4. On the Roles page, choose Create role.

5. Choose Custom trust policy.

6. Enter information for the trust policy as shown in the example below, and edit it according to the project information you received in step 1.

   • Change project-role-arn to be the project role ARN you received from the Amazon SageMaker Unified Studio project member.

   • Change project-id to be the project ID you received from the Amazon SageMaker Unified Studio project member.

   
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "project-role-arn"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                   "StringEquals": {
                       "sts:ExternalId": "project-id" 
                   }
               }
           },
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "project-role-arn"
               },
               "Action": [
                   "sts:SetSourceIdentity"
               ],
               "Condition": {
                   "StringLike": {
                       "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}"
                   }
               }
           }
       ]
   }

7. Choose Next.

8. Under Role name, enter a name for the role.

9. (Optional) Enter a description for the role.

10. Choose Create role.

Attach permissions to the role

1. Select the role you have created in the AWS IAM console.

2. Choose Add permissions > Create inline policy.

3. Enter information as shown in the example below, and edit it according to the information for your Amazon EMR clusters that you want to grant access to.

   • Change the EMR cluster ARN to be the ARN for the cluster. You can find this on the cluster details page in the Amazon EMR console by selecting the cluster ID of the cluster that you want to share.

     Note

     You can use an asterisk instead of the Amazon EMR cluster ID if you want to grant access to all clusters instead of just one.

   • Change the certificate path to the one defined in the Amazon EMR security configuration for that cluster in the Amazon EMR console. For more information, see Specify a security configuration for an Amazon EMR cluster in the Amazon EMR Management Guide.

   
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "EmrAccess",
               "Effect": "Allow",
               "Action": [
                   "elasticmapreduce:ListInstances",
                   "elasticmapreduce:DescribeCluster",
                   "elasticmapreduce:GetClusterSessionCredentials" # Skip this for non-runtime role clusters
               ],
               "Resource": "arn:aws:elasticmapreduce:us-east-1:666777888999:cluster/j-AB1CDEFGHIJK" # EMR cluster ARN
           },
           {
               "Sid": "EMRSelfSignedCertAccess",
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject"
               ],
               "Resource": [
                   "arn:aws:s3:::666777888999-us-east-1-sam-dev/my-certs.zip" # Cert path defined in the EMR security configuration
               ]
           },
           {
               "Sid": "EMRSecurityConfigurationAccess",
               "Effect": "Allow",
               "Action": [
                   "elasticmapreduce:DescribeSecurityConfiguration"
               ],
               "Resource": [
                   "*"
               ]
           }
       ]
   }
               

4. Choose Next.

5. Under Policy name, enter a name for the polciy.

6. Choose Create policy. You can then see the permissions policy listed on the page for the role you created in the IAM console.

Send information to project members

1. Copy the ARN of the EMR access role you created in the IAM console and send it to the Amazon SageMaker Unified Studio project member you want to grant access to.

2. Copy the Amazon EMR cluster ARN that you added to the permissions policy and send it to the Amazon SageMaker Unified Studio project member you want to grant access to.

3. From the Amazon EMR on EC2 cluster details page in the Amazon EMR console, copy the EC2 instance profile string and search for it on the Roles page in the IAM console to find the role that contains the Amazon EC2 instance profile ARN.

4. Select the name of the role that contains the instance profile ARN to open the role details page, then copy the ARN and send it to the Amazon SageMaker Unified Studio project member you want to grant access to.