EMR Runtime Roles for Scoped Access and IMDSv2

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Create EMR runtime roles and configure the cluster to use them to submit workloads.

Question

A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team’s big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster’s underlying EC2 instances. Which solution will meet these requirements?
  1. Configure interface VPC endpoints for each AWS service that the teams need. Use the required interface VPC endpoints to submit the big data workloads.
  2. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads. Correct Answer
  3. Create an EC2 IAM instance profile that has the required permissions for each team. Use the instance profile to submit the big data workloads.
  4. Create an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false. Use the security configuration to submit the big data workloads.

Key Takeaways

The exam traps candidates into choosing instance profiles or VPC endpoints, but only EMR runtime roles allow granular per-job permissions and explicitly bypass EC2 metadata service access.

This question tests the use of Amazon EMR runtime roles to enforce least-privilege access for big data workloads while disabling Instance Metadata Service (IMDS) access on underlying EC2 instances.

Common mistake: Candidates often select option C (EC2 IAM instance profile) because it is the standard way to grant permissions to EC2 instances, failing to realize that instance profiles rely on IMDS and cannot be scoped per job.

Expert Analysis

Why the Answer Is Correct

Option B is correct because EMR runtime roles are specifically designed to provide fine-grained, step-level IAM permissions. According to AWS documentation, when a runtime role is specified for an EMR step, the jobs run with that role's permissions and "can't access the Instance Metadata Service on the EC2 instances of the cluster." This perfectly satisfies both requirements: scoped access per team/job and no IMDSv2 access.

Why the Other Options Are Wrong

Option A (Interface VPC Endpoints) restricts network traffic but does not control IAM permissions; workloads would still have broad IAM access via the instance profile. Option C (EC2 IAM instance profile) grants permissions to the entire node, not individual teams, and inherently requires access to the Instance Metadata Service to retrieve credentials, violating the security requirement. Option D (Security Configuration with EnableApplicationScopedIAMRole false) disables the feature that allows application-scoped roles, reverting to node-level permissions which is the opposite of the desired outcome.

Community Comment Notes

The community consensus strongly supports Option B. One user noted that runtime roles resolve the issue where all jobs share union permissions by allowing specific IAM roles per step. Another comment highlighted that while EC2 mandates IMDSv2, EMR runtime roles allow access to resources without using the instance metadata service at all.

Official Reference

https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-security-model.html#emr-security-model-runtime-roles

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions mention 'multiple teams' sharing a cluster and needing distinct permissions, look for 'runtime roles' or 'step-level roles'. If the question also prohibits IMDS access, runtime roles are the definitive solution as they decouple credentials from the EC2 instance metadata.

Frequently Asked Questions

Why can't I use EC2 Instance Profiles for this scenario?

Instance profiles attach permissions to the EC2 node itself, meaning all jobs on that node share the same permissions. They also require accessing IMDS to get temporary credentials, which violates the requirement.

Does enabling IMDSv2 solve the metadata access issue?

No, the requirement is to ensure workloads do NOT access IMDSv2. EMR runtime roles achieve this by injecting credentials directly into the job environment rather than fetching them from the metadata service.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. [Removed] 👍 3 Answered B
    Explanation: EMR Runtime Roles: By creating EMR runtime roles, you can assign specific IAM roles to individual EMR jobs or steps. Each role can have fine-grained permissions, allowing you to restrict access to only the AWS services each team needs. This provides a highly controlled environment where each team's workload operates under the principle of least privilege. IMDSv2 Access: When using runtime roles, you do not rely on the EC2 instance profile for service access, thereby minimizing the need for the workloads to access the Instance Metadata Service. This can help in reducing the risk of unauthorized access to IMDSv2.
  2. FlyingHawk 👍 2 Answered B
    When you specify a runtime role for an Amazon EMR step, the jobs or queries that you submit can only access AWS resources that the policies attached to the runtime role allow. These jobs and queries can't access the Instance Metadata Service on the EC2 instances of the cluster or use the EC2 instance profile of the cluster to access any AWS resources. https://aws.amazon.com/blogs/big-data/introducing-runtime-roles-for-amazon-emr-steps-use-iam-roles-and-aws-lake-formation-for-access-control-with-amazon-emr/ https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-steps-runtime-roles.html
  3. martinadurcakova1 👍 2 Answered B
    B. Creating EMR runtime roles and configuring the cluster to use them is the correct solution. EMR runtime roles allow you to grant specific permissions to the big data workloads, ensuring that each team's workloads can only access the required AWS services. Additionally, the runtime roles can be configured to disable access to IMDSv2, meeting the requirement.
  4. dhewa 👍 2 Answered B
    This approach avoids the need for workloads to access the Instance Metadata Service (IMDSv2) on the underlying EC2 instances, as the permissions are managed through the runtime roles.
  5. EllenLiu 👍 1 Answered B
    runtime role is used to resolve the issue that there is only union permissions for all jobs and queries we can use. just like it mentions, for ec2, IMDSv2 is mandatory, however we can use runtime role to access instance metadata on ec2 avoid using IMDSv2

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide