CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2aws-lambdaamazon-emr
Rushabh Doshi
Rushabh Doshi

Reputation: 21

Service role EMR_DefaultRole has insufficient EC2 permissions

While creating AWS EMR cluster, always i get the issue- Service role EMR_DefaultRole has insufficient EC2 permissions

And the cluster terminates automatically, have even done steps as per aws documentation of recreating emr specific roles, but no progress please guide how to resolve the issue- Service role EMR_DefaultRole has insufficient EC2 permissions

Upvotes: 2

Views: 3649

Answers (1)

IamSoo
IamSoo

Reputation: 103

EMR needs two roles to start the cluster 1) EC2 Instance profile role 2)EMR Service role. The service role should have enough permissions to provision new resources to start the cluster, EC2 instances, their network etc. There could be many reasons for this common error:

  1. Verify the resources and their actions. Refer https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-role.html.

  2. Check if you are passing the tag that signifies if cluster needs to use emr managed policy.

                {
                    "Key": "for-use-with-amazon-emr-managed-policies",
                    "Value": "true"
                }
  1. At last try to find out the exact reason from cloud trail. Go to aws>cloud trail. From the event history configuration enable the error code so that you can see the exact error. If you find the error code something like 'You are not authorized to perform this operation. Encoded authorization failure message'. Then open the event history details, pick up the encrypted error message and decrypt using aws cli aws sts decode-authorization-message message. This will show you the complete role details, event, resources, action. Compare it with AWS IAM permissions and you can find out the missing permission or parameter that you need to pass while creating the job flow.

Upvotes: 2

Related Questions