When you use E-MapReduce (EMR) on Elastic Compute Service (ECS), you must be granted the permissions to access other Alibaba Cloud services and perform related operations. This topic describes how to use an Alibaba Cloud account to allow the default roles required by EMR to be automatically created when you use EMR for the first time.
Background information
EMR provides an Alibaba Cloud account with default system roles and system policies. System policies are created and maintained by Alibaba Cloud. If service requirements change, the system policies are accordingly updated.
When you use EMR for the first time, you must use your Alibaba Cloud account to assign the AliyunEMRDefaultRole and AliyunECSInstanceForEMRRole or AliyunEmrEcsDefaultRole roles to EMR. After the roles are assigned, you can view the roles in the RAM console and attach policies to the roles. For more information about roles, see RAM role overview.
Roles that are required for EMR vary based on the EMR version.
In EMR V3.32.0 or an earlier minor version, or EMR V4.5.0 or an earlier minor version: AliyunEmrEcsDefaultRole
In a minor version later than EMR V3.32.0 or EMR V4.5.0: AliyunECSInstanceForEMRRole
When you use EMR for the first time, you must use your Alibaba Cloud account or a RAM user to assign default system roles to EMR. Otherwise, your Alibaba Cloud account and the RAM users within your Alibaba Cloud account cannot use EMR.
If you want to delete a service role, make sure that the resources that use the role are released. Otherwise, the use of the resources is affected.
If only some roles are assigned, the EMR console sends you a notification. You can create a cluster only after all roles are assigned.
Procedure
Log on to the EMR console by using your Alibaba Cloud account.
Go to the Dependency Check page, find the desired check item, and then click Authorize Now in the Actions column.
On the Cloud Resource Access Authorization page, click Agree to Authorization in the lower part of the page.
On the Users page of the RAM console, view the created roles.
Default roles
The following table describes the default RAM roles that are associated with EMR.
Attribute | Default role | Description | System policy |
EMR service role | AliyunEMRDefaultRole | This role allows you to use EMR to access other Alibaba Cloud services when you configure resources and perform service-level operations on your EMR cluster. This role is required for all clusters and cannot be changed. For more information, see EMR service roles. | AliyunEMRRolePolicy |
AliyunEMRManagedCostRole | This role is used when you use the auto scaling cost analysis feature for the first time. This role allows you to view bill details on the billing management page. | AliyunEMRManagedCostRolePolicy | |
ECS application role (used in EMR V3.32.0 or an earlier minor version, or EMR V4.5.0 or an earlier minor version) | AliyunEmrEcsDefaultRole | This role allows application processes that run on your cluster to access other Alibaba Cloud services. When you create a cluster, you can use this service role or use a custom role. For more information about this role, see ECS application role (used in EMR V3.32.0 or an earlier minor version, or EMR V4.5.0 or an earlier minor version). | AliyunEMRECSRolePolicy |
ECS application role (used in a minor version later than EMR V3.32.0 or EMR V4.5.0) | AliyunECSInstanceForEMRRole | This role allows application processes that run on your cluster to access other Alibaba Cloud services. When you create a cluster, you can use this service role or use a custom role. For more information about this role, see ECS application role (used in a minor version later than EMR V3.32.0 or EMR V4.5.0 and EMR 5.X series). | AliyunECSInstanceForEMRRolePolicy |
ECS application role (used in EMR Studio by default) | AliyunECSInstanceForEMRStudioRole | This role allows you to use EMR Studio to access your resources in other Alibaba Cloud services. If this role is not assigned to your account, a window appears, which prompts you to assign this role when you create an EMR Studio cluster for the first time. To assign this role, use your Alibaba Cloud account. | AliyunECSInstanceForEMRStudioRolePolicy |
What to do next
After you assign roles to your Alibaba Cloud account, you can create EMR clusters to use EMR. We recommend that you manage EMR clusters as a RAM user. You can refer to Create a RAM user and Grant permissions to RAM users to create a RAM user and grant the required collaborative development permissions to the RAM user.