CODEWITHSUNDEEP
amazon-web-servicesemramazon-iam
NSA
NSA

Reputation: 6027

AWS EMR Cluster fails to launch

I am trying to launch an AWS EMR Cluster from the AWS Console, and am getting the following error:

Failed to provision ec2 instances because 'IAM Instance Profile "arn:aws:iam::553706642095:instance-profile/EMR_EC2_DefaultRole" has no associated IAM Roles

Any one know what this means and how to resolve it?

The following is the role policy:

{
  "Statement": [
    {
      "Action": [
        "cloudwatch:*",
        "dynamodb:*",
        "ec2:Describe*",
        "elasticmapreduce:Describe*",
        "rds:Describe*",
        "s3:*",
        "sdb:*",
        "sns:*",
        "sqs:*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Its trust policy document is:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Upvotes: 5

Views: 4643

Answers (4)

Bala
Bala

Reputation: 1

I got the same issue. Instead of giving new cluster name, i just kept the same default cluster name 'My Cluster' and clicked on 'Create cluster' again. It created without this error.

Upvotes: 0

lony
lony

Reputation: 7750

I tried around and could get it to work without the tool using my own Cloudformation stack.

The key you have to have a InstanceProfile for the flow role and both flow and service role have to be provided as ARN.

That's how I got it to work for me!

Hope that helps someone else as well.

Upvotes: 0

pythonjsgeo
pythonjsgeo

Reputation: 5411

I finally resolved this issue. This was confusing because the instance-profile and the role use the same name by default. Full steps outline below, but you may be able to skip various steps.

  1. Create default roles (if error, downgrade to awscli version 1.10.30)

    aws emr create-default-roles

  2. Create instance profile if it doesn't already exist:

    aws iam create-instance-profile --instance-profile-name EMR_EC2_DefaultRole

  3. Verify that instance profile exists but doesn't have any roles:

    aws iam get-instance-profile --instance-profile-name EMR_EC2_DefaultRole

  4. Add the role using:

    aws iam add-role-to-instance-profile --instance-profile-name EMR_EC2_DefaultRole --role-name EMR_EC2_DefaultRole

Upvotes: 6

Sandesh Deshmane
Sandesh Deshmane

Reputation: 2305

You have only readonly permission for EMR

"elasticmapreduce:Describe*",

You need to give full access to elastic map reduce so that you can launch cluster/terminate

once you give this access role policy will look like

"elasticmapreduce:*",

Upvotes: 0

Related Questions