In EMR versions 3.32 and later, 4.5 and later, and 5.x, the MetaService is replaced with an ECS application role. This role is automatically attached to each ECS instance in an EMR cluster when you create or scale out the cluster. Applications running on the EMR cluster use this role to obtain permissions to interact with other cloud services. This allows applications to access Alibaba Cloud resources without an AccessKey, which avoids exposing an AccessKey in configuration files.
Prerequisites
The required role must be authorized. For more information, see Alibaba Cloud account role authorization.
Permissions
The default role AliyunECSInstanceForEMRRole includes the system policy AliyunECSInstanceForEMRRolePolicy. The following table lists the permissions for OSS, Tablestore, and DLF.
|
Action |
Description |
|
oss:PutObject |
Uploads an object, such as a file or folder. |
|
oss:GetObject |
Retrieves an object, such as a file or folder. |
|
oss:ListObjects |
Lists objects. |
|
oss:DeleteObject |
Deletes a specified object. |
|
oss:ListBuckets |
Lists all buckets. |
|
oss:AbortMultipartUpload |
Aborts a multipart upload event. |
|
oss:ListMultipartUploads |
Lists all in-progress multipart upload events. |
|
oss:RestoreObject |
Restores an object of the Archive or Cold Archive storage class. |
|
oss:GetBucketInfo |
Retrieves information about a specified bucket. |
|
oss:ListObjectVersions |
Lists the versions of all objects in a bucket, including delete markers. |
|
oss:DeleteObjectVersion |
Deletes a specified version of an object. |
|
oss:PostDataLakeStorageFileOperation |
Grants permissions to access OSS-HDFS. |
|
ots:CreateTable |
Creates a data table with the specified structure. |
|
ots:DeleteTable |
Deletes a specified data table. |
|
ots:GetRow |
Reads a single data row by its primary key. |
|
ots:PutRow |
Inserts data into a specified row. |
|
ots:UpdateRow |
Updates data in a specified row. |
|
ots:DeleteRow |
Deletes a specified row. |
|
ots:GetRange |
Reads data within a specified primary key range. |
|
ots:BatchWriteRow |
Inserts, updates, or deletes multiple rows in one or more tables. |
|
ots:BatchGetRow |
Reads multiple rows from one or more tables. |
|
ots:ComputeSplitPointsBySize |
Logically splits a table into multiple shards of a specified approximate size, and returns the split points and host suggestions for the shards. |
|
ots:StartLocalTransaction |
Starts a local transaction on a partition key and returns the transaction ID. |
|
ots:CommitTransaction |
Commits a local transaction. |
|
ots:AbortTransaction |
Aborts a local transaction. |
|
dlf:BatchCreatePartitions |
Creates multiple partitions. |
|
dlf:BatchCreateTables |
Creates multiple data tables. |
|
dlf:BatchDeletePartitions |
Deletes multiple partitions. |
|
dlf:BatchDeleteTables |
Deletes multiple data tables. |
|
dlf:BatchGetPartitions |
Retrieves multiple partitions. |
|
dlf:BatchGetTables |
Retrieves multiple data tables. |
|
dlf:BatchUpdatePartitions |
Updates information about multiple partitions. |
|
dlf:BatchUpdateTables |
Updates multiple data tables. |
|
dlf:CreateDatabase |
Creates a database. |
|
dlf:CreateFunction |
Creates a function. |
|
dlf:CreatePartition |
Creates a partition. |
|
dlf:CreateTable |
Creates a data table. |
|
dlf:DeleteDatabase |
Deletes a database. |
|
dlf:DeleteFunction |
Deletes a function. |
|
dlf:DeletePartition |
Deletes a partition. |
|
dlf:DeleteTable |
Deletes a data table. |
|
dlf:GetDatabase |
Retrieves a database. |
|
dlf:GetFunction |
Retrieves a function. |
|
dlf:GetPartition |
Retrieves a partition. |
|
dlf:GetTable |
Retrieves a data table. |
|
dlf:ListCatalogs |
Lists data catalogs. |
|
dlf:ListDatabases |
Lists databases. |
|
dlf:ListFunctionNames |
Lists the names of functions. |
|
dlf:ListFunctions |
Lists functions. |
|
dlf:ListPartitionNames |
Lists the names of partitions. |
|
dlf:ListPartitions |
Lists partitions. |
|
dlf:ListPartitionsByExpr |
Lists partitions in a metadata table based on an expression. |
|
dlf:ListPartitionsByFilter |
Lists partitions in a metadata table based on a filter. |
|
dlf:ListTableNames |
Lists the names of data tables. |
|
dlf:ListTables |
Lists data tables. |
|
dlf:RenamePartition |
Renames a partition. |
|
dlf:RenameTable |
Renames a data table. |
|
dlf:UpdateDatabase |
Updates database information. |
|
dlf:UpdateFunction |
Updates function information. |
|
dlf:UpdateTable |
Updates data table information. |
|
dlf:UpdateTableColumnStatistics |
Updates column statistics for a metadata table. |
|
dlf:GetTableColumnStatistics |
Retrieves column statistics for a metadata table. |
|
dlf:DeleteTableColumnStatistics |
Deletes column statistics for a metadata table. |
|
dlf:UpdatePartitionColumnStatistics |
Updates column statistics for a partition. |
|
dlf:GetPartitionColumnStatistics |
Retrieves column statistics for a partition. |
|
dlf:DeletePartitionColumnStatistics |
Deletes column statistics for a partition. |
|
dlf:BatchGetPartitionColumnStatistics |
Retrieves column statistics for multiple table partitions. |
|
dlf:CreateLock |
Creates a metadata lock. |
|
dlf:UnLock |
Releases a specified metadata lock. |
|
dlf:AbortLock |
Aborts a metadata lock. |
|
dlf:RefreshLock |
Refreshes a metadata lock. |
|
dlf:GetLock |
Retrieves a metadata lock. |
|
dlf:GetAsyncTaskStatus |
Retrieves the status of an asynchronous task. |
|
dlf:DeltaGetPermissions |
Retrieves a list of permissions. |
|
dlf:GetPermissions |
Retrieves data permission information. |
|
dlf:GetServiceInfo |
Retrieves service information. |
|
dlf:GetRoles |
Retrieves role information. |
|
dlf:CheckPermissions |
Verifies data permissions. |
Use caution when you edit or delete the default role AliyunECSInstanceForEMRRole. Otherwise, cluster creation or job execution will fail.
Using the ECS role for temporary credentials
You can use a temporary credential from STS to access other cloud resources. For more information, see Instance RAM roles.