Package software.amazon.awscdk.services.emr

Class CfnSecurityConfiguration

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.CfnElement
software.amazon.awscdk.CfnRefElement
software.amazon.awscdk.CfnResource
software.amazon.awscdk.services.emr.CfnSecurityConfiguration
All Implemented Interfaces:
IEnvironmentAware, IInspectable, ISecurityConfigurationRef, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
@Generated(value="jsii-pacmak/1.118.0 (build 02eec31)", date="2025-11-10T13:40:06.130Z") @Stability(Stable) public class CfnSecurityConfiguration extends CfnResource implements IInspectable, ISecurityConfigurationRef
Use a SecurityConfiguration resource to configure data encryption, Kerberos authentication (available in Amazon EMR release version 5.10.0 and later), and Amazon S3 authorization for EMRFS (available in EMR 5.10.0 and later). You can re-use a security configuration for any number of clusters in your account. For more information and example security configuration JSON objects, see Create a Security Configuration in the Amazon EMR Management Guide .

Example: 

 import software.amazon.awscdk.services.emr.*;
 CfnSecurityConfiguration cfnSecurityConfiguration = CfnSecurityConfiguration.Builder.create(this, "EmrSecurityConfiguration")
         .name("AddStepRuntimeRoleSecConfig")
         .securityConfiguration(JSON.parse("\n    {\n      \"AuthorizationConfiguration\": {\n          \"IAMConfiguration\": {\n              \"EnableApplicationScopedIAMRole\": true,\n              \"ApplicationScopedIAMRoleConfiguration\":\n                  {\n                      \"PropagateSourceIdentity\": true\n                  }\n          },\n          \"LakeFormationConfiguration\": {\n              \"AuthorizedSessionTagValue\": \"Amazon EMR\"\n          }\n      }\n    }"))
         .build();
 EmrCreateCluster task = EmrCreateCluster.Builder.create(this, "Create Cluster")
         .instances(InstancesConfigProperty.builder().build())
         .name(TaskInput.fromJsonPathAt("$.ClusterName").getValue())
         .securityConfiguration(cfnSecurityConfiguration.getName())
         .build();
 Role executionRole = Role.Builder.create(this, "Role")
         .assumedBy(new ArnPrincipal(task.getClusterRole().getRoleArn()))
         .build();
 executionRole.assumeRolePolicy.addStatements(
 PolicyStatement.Builder.create()
         .effect(Effect.ALLOW)
         .principals(List.of(task.getClusterRole()))
         .actions(List.of("sts:SetSourceIdentity"))
         .build(),
 PolicyStatement.Builder.create()
         .effect(Effect.ALLOW)
         .principals(List.of(task.getClusterRole()))
         .actions(List.of("sts:TagSession"))
         .conditions(Map.of(
                 "StringEquals", Map.of(
                         "aws:RequestTag/LakeFormationAuthorizedCaller", "Amazon EMR")))
         .build());
 EmrAddStep.Builder.create(this, "Task")
         .clusterId("ClusterId")
         .executionRoleArn(executionRole.getRoleArn())
         .name("StepName")
         .jar("Jar")
         .actionOnFailure(ActionOnFailure.CONTINUE)
         .build();

See Also:

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnSecurityConfiguration

      protected CfnSecurityConfiguration(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnSecurityConfiguration

      protected CfnSecurityConfiguration(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnSecurityConfiguration

      @Stability(Stable) public CfnSecurityConfiguration(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull CfnSecurityConfigurationProps props)
      Parameters:
      scope - Scope in which this resource is defined. This parameter is required.
      id - Construct identifier for this resource (unique in its scope). This parameter is required.
      props - Resource properties. This parameter is required.

  • Method Details

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector - tree inspector to collect and process attributes. This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getSecurityConfigurationRef

      @Stability(Stable) @NotNull public SecurityConfigurationReference getSecurityConfigurationRef()
      A reference to a SecurityConfiguration resource.
      Specified by:
      getSecurityConfigurationRef in interface ISecurityConfigurationRef

    • getSecurityConfiguration

      @Stability(Stable) @NotNull public Object getSecurityConfiguration()
      The security configuration details in JSON format.

    • setSecurityConfiguration

      @Stability(Stable) public void setSecurityConfiguration(@NotNull Object value)
      The security configuration details in JSON format.

    • getName

      @Stability(Stable) @Nullable public String getName()
      The name of the security configuration.

    • setName

      @Stability(Stable) public void setName(@Nullable String value)
      The name of the security configuration.