Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a few EMR jobflows, and populating hive tables directly from S3. Naturally, it would not be ideal to drop these tables, and so I'm wondering:

Is it possible to run EMR jobflows such that the jobflow has read-only access? Most importantly, I would want it to not be possible to drop tables via hive.

The ideal solution would involve something similar to the IAM user - I'd like to be able to generate security credentials which are linked to the permissions, so that people with the proper security credentials could ssh into the instance and have only the permissions that I have alloted to them.

share|improve this question
up vote 0 down vote accepted

This may be subject to change in the near future, as AWS is a developing platform, but currently, the way we have been advised to do this by Amazon reps is to create a separate account, and grant read-only access to this account object by object. There is also currently not a good method for granting read permissions to all of the objects in a bucket - I am currently using the boto library to update all of the permissions programatically, which can take quite long if there are lots of objects.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.