When using Elastic MapReduce (EMR), you need to grant the system default role EMR_QCSRole to the service account. Only after the role is successfully granted can EMR call related services such as Tencent Kubernetes Engine (TKE) to create clusters, store logs, and perform other operations.
Attention
If this is the first time you activate EMR, use the root account to complete role authorization. Otherwise, neither sub-accounts nor the root account can use EMR.
Role Authorization Process
1. Click Go to Cloud Access Management to complete role authorization. This step is performed in the following scenario: When you create a cluster or an on-demand execution plan, if the role EMR_QCSRole fails to be granted to the service account, the following prompt is displayed.
2. Click Agree to Authorize to grant the default role EMR_QCSRole to the EMR service account.
3. After role authorization is completed, refresh the EMR console or the purchase page. You can then proceed with normal operations. For more detailed policy information related to the role EMR_QCSRole, log in to the Cloud Access Management console. For the permissions included in the role EMR_QCSRole, see Collaborator/Sub-user Authorization. Special Instructions for Service Role Authorization Related to EMR on TKE Clusters
When you create or use an EMR on TKE cluster, data needs to be directly written to or calculated in Cloud
Object Storage (COS). To ensure data security, EMR must be granted temporary keys to read and write
COS resources. Therefore, the relevant EMR service-related role EMR_QCSLinkedRoleInApplicationDataAccess needs to be authorized and bound to the QcloudAccessForEMRLinkedRoleInApplicationDataAccess preset policy.
1. When you view the EMR on TKE cluster list, check whether the EMR service-related role EMR_QCSLinkedRoleInApplicationDataAccess is bound.
2. If the EMR service-related role EMR_QCSLinkedRoleInApplicationDataAccess is not bound, authorization and binding need to be performed.
In addition to the service-related roles mentioned above, you also need to authorize the corresponding service-related roles when using certain features of EMR on TKE clusters:
When using managed scaling, you need to grant the EMR service-related role EMR_QCSLinkedRoleInNodeAutoscaling. This role authorizes EMR to access Tencent Cloud resources such as Cloud Virtual Machine (CVM), TKE, and EMR without requiring you to manage keys. This makes operations more efficient and secure.
When using the VPC-CNI container network plugin, you need to grant the service-related role IPAMDofTKE_QCSRole. This role allows the container network component to manage Virtual Private Cloud (VPC) resources such as elastic network interfaces (ENIs) and IP addresses on your behalf.
Attention:
If the above authorization is not completed, the corresponding features cannot be properly used. When a feature is enabled, click Agree to Authorize in the displayed authorization dialog box. After authorization is completed, refresh the console page to proceed with normal operations.
Instructions for EMR on TKE Cluster Authentication