How can I allow an AWS EMR Cluster to create service-linked roles

Question

I'm trying to stand up a new cluster in AWS EMR, but it immediately fails with the following error:

Service-linked role 'AWSServiceRoleForEMRCleanup' for EMR is required. Please create this role directly or add permission to create it in your IAM entity.

My service role for EMR has the following permission:

  - Effect: Allow
    Action:
      - iam:CreateServiceLinkedRole
      - iam:PutRolePolicy
    Resource:
      - "arn:aws:iam::<account-id>:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup"

I've tried using * as the resource as well, which produces the same results.

I have also attempted to create the role directly as the error suggests, but that fails due to AWSServiceRole being a reserved prefix for role names created by AWS.

FoxMulder900 · Accepted Answer · 2025-02-20 23:09:03Z

0

The solution was to add the CreateServiceLinkedRole permission to the IAM role of the user making the calls, NOT the EMR service role.

answered Feb 20 at 23:09

FoxMulder900

1,28113 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How can I allow an AWS EMR Cluster to create service-linked roles

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related