Configure Amazon EMR CloudFormation templates in the Service Catalog

Step 1: Retrieve the ARN of the SageMaker execution role used by your private space.

For information on spaces and execution roles in SageMaker, see Understanding domain space permissions and execution roles.

For more information about how to retrieve the ARN of SageMaker's execution role, see Get your execution role.

Step 2: Attach the following permissions to the SageMaker execution role accessing your Amazon EMR clusters.

1. Navigate to the IAM console.

2. Choose Roles and then search for your execution role by name in the Search field. The role name is the last part of the ARN, after the last forward slash (/).

3. Follow the link to your role.

4. Choose Add permissions and then Create inline policy.

5. In the JSON tab, add the Amazon EMR permissions allowing Amazon EMR access and operations. For details on the policy document, see List Amazon EMR policies in Reference policies. Replace the region, and accountID with their actual values before copying the list of statements to the inline policy of your role.

6. Choose Next and then provide a Policy name.

7. Choose Create policy.

8. Repeat the Create inline policy step to add another policy granting the execution role the permissions to provision new Amazon EMR clusters using AWS CloudFormation templates. For details on the policy document, see Create Amazon EMRclusters policies in Reference policies. Replace the region and accountID with their actual values before copying the list of statements to the inline policy of your role.

Step 1: Retrieve the ARN of the service role of your Amazon EMR cluster.

To learn about how to find the ARN of the service role of a cluster, see Configure IAM service roles for Amazon EMR permissions to AWS services and resources.

Step 2: Create a custom IAM role named AssumableRole with the following configuration:

By assuming the role, Studio or Studio Classic can gain temporary access to the permissions it needs in Amazon EMR.

For detailed instructions on how to create a new AssumableRole in your Amazon EMR AWS account, follow these steps:

1. Navigate to the IAM console.

2. In the left navigation pane, choose Policy, and then Create policy.

3. In the JSON tab, add the Amazon EMR permissions allowing Amazon EMR access and operations. For details on the policy document, see List Amazon EMR policies in Reference policies. Replace the region, and accountID with their actual values before copying the list of statements to the inline policy of your role.

4. Choose Next and then provide a Policy name.

5. Choose Create policy.

6. In the left navigation pane, choose Roles and then Create role.

7. On the Create role page, choose Custom trust policy as the trusted entity.

8. Paste in the following JSON document in the Custom trust policy section and then choose Next.

   For users of Studio and JupyterLab

   Replace studio-account with the Studio account ID, and AmazonSageMaker-ExecutionRole with the execution role used by your JupyterLab space.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::studio-account:role/service-role/AmazonSageMaker-ExecutionRole"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }

   For users of Studio Classic

   Replace studio-account with the Studio Classic account ID.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::studio-account:root"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

9. In the Add permissions page, add the permission you just created and then choose Next.

10. On the Review page, enter a name for the role such as AssumableRole and an optional description.

11. Review the role details and choose Create role.

For more information about creating a role on an AWS account, see Creating an IAM role (console).

Step 1: Retrieve the ARN of the SageMaker execution role used by your private space.

For information on spaces and execution roles in SageMaker, see Understanding domain space permissions and execution roles.

For more information about how to retrieve the ARN of SageMaker's execution role, see Get your execution role.

Step 2: Attach the following permissions to the SageMaker execution role accessing your Amazon EMR clusters.

1. Navigate to the IAM console.

2. Choose Roles and then search for your execution role by name in the Search field. The role name is the last part of the ARN, after the last forward slash (/).

3. Follow the link to your role.

4. Choose Add permissions and then Create inline policy.

5. In the JSON tab, add the inline policy granting the role permissions to update the domains, user profiles, and spaces. For details on the policy document, see Domain, user profile, and space update actions policy in Reference policies. Replace the region and accountID with their actual values before copying the list of statements to the inline policy of your role.

6. Choose Next and then provide a Policy name.

7. Choose Create policy.

8. Repeat the Create inline policy step to add another policy granting the execution role the permissions to assume the AssumableRole and then perform actions permitted by the role's access policy. Replace emr-account with the Amazon EMR account ID, and AssumableRole with the name of the assumable role created in the Amazon EMR account.

   {
     "Version": "2012-10-17",
     "Statement": [
     { 
               "Sid": "AllowRoleAssumptionForCrossAccountDiscovery", 
               "Effect": "Allow", 
               "Action": "sts:AssumeRole", 
               "Resource":  ["arn:aws:iam::emr-account:role/AssumableRole" ]
     }]
   }

9. Repeat the Create inline policy step to add another policy granting the execution role the permissions to provision new Amazon EMR clusters using AWS CloudFormation templates. For details on the policy document, see Create Amazon EMRclusters policies in Reference policies. Replace the region and accountID with their actual values before copying the list of statements to the inline policy of your role.

10. (Optional) To allow listing Amazon EMR clusters deployed in the same account as Studio, add an additional inline policy to your Studio execution role as defined in List Amazon EMR policies in Reference policies.

Step 3: Associate your assumable role(s) (access role) with your domain or user profile. JupyterLab users in Studio can use the SageMaker console or the provided script.

Choose the tab that corresponds to your use case.