Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running a few EMR jobflows, and populating hive tables directly from S3. Naturally, it would not be ideal to drop these tables, and so I'm wondering:

Is it possible to run EMR jobflows such that the jobflow has read-only access? Most importantly, I would want it to not be possible to drop tables via hive.

The ideal solution would involve something similar to the IAM user - I'd like to be able to generate security credentials which are linked to the permissions, so that people with the proper security credentials could ssh into the instance and have only the permissions that I have alloted to them.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

This may be subject to change in the near future, as AWS is a developing platform, but currently, the way we have been advised to do this by Amazon reps is to create a separate account, and grant read-only access to this account object by object. There is also currently not a good method for granting read permissions to all of the objects in a bucket - I am currently using the boto library to update all of the permissions programatically, which can take quite long if there are lots of objects.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.