AWS API Changes

2026/07/21 - Amazon EMR Containers - 1 new 3 updated api methods

Changes Added support for the DeleteSecurityConfiguration API, which allows customers to delete security configurations in Amazon EMR on EKS. Also added authenticationConfiguration in securityConfigurationdata structure.

DeleteSecurityConfiguration (new)

Link ¶

Deletes a security configuration.

See also: AWS API Documentation

Request Syntax

client.delete_security_configuration(
    id='string'
)

type id:

string

param id:

[REQUIRED]

The ID of the security configuration to delete.

rtype:

dict

returns:

Response Syntax

{
    'id': 'string'
}

Response Structure

(dict) --
- id (string) --
  
  The ID of the security configuration that was deleted.

CreateSecurityConfiguration (updated)

Link ¶
Changes (request)

{'securityConfigurationData': {'authenticationConfiguration': {'iamConfiguration': {'systemRole': 'string'},
                                                               'identityCenterConfiguration': {'emrIdentityCenterApplicationARN': 'string',
                                                                                               'enableIdentityCenter': 'boolean',
                                                                                               'identityCenterApplicationAssignmentRequired': 'boolean',
                                                                                               'identityCenterInstanceARN': 'string'}}}}

Creates a security configuration. Security configurations in Amazon EMR on EKS are templates for different security setups. You can use security configurations to configure the Lake Formation integration setup. You can also create a security configuration to re-use a security setup each time you create a virtual cluster.

See also: AWS API Documentation

Request Syntax

client.create_security_configuration(
    clientToken='string',
    name='string',
    containerProvider={
        'type': 'EKS',
        'id': 'string',
        'info': {
            'eksInfo': {
                'namespace': 'string',
                'nodeLabel': 'string'
            }
        }
    },
    securityConfigurationData={
        'authorizationConfiguration': {
            'lakeFormationConfiguration': {
                'authorizedSessionTagValue': 'string',
                'secureNamespaceInfo': {
                    'clusterId': 'string',
                    'namespace': 'string'
                },
                'queryEngineRoleArn': 'string'
            },
            'encryptionConfiguration': {
                'inTransitEncryptionConfiguration': {
                    'tlsCertificateConfiguration': {
                        'certificateProviderType': 'PEM',
                        'publicCertificateSecretArn': 'string',
                        'privateCertificateSecretArn': 'string'
                    }
                }
            }
        },
        'authenticationConfiguration': {
            'identityCenterConfiguration': {
                'enableIdentityCenter': True|False,
                'identityCenterApplicationAssignmentRequired': True|False,
                'identityCenterInstanceARN': 'string',
                'emrIdentityCenterApplicationARN': 'string'
            },
            'iamConfiguration': {
                'systemRole': 'string'
            }
        }
    },
    tags={
        'string': 'string'
    }
)

type clientToken:

string

param clientToken:

[REQUIRED]

The client idempotency token to use when creating the security configuration.

This field is autopopulated if not provided.

type name:

string

param name:

[REQUIRED]

The name of the security configuration.

type containerProvider:

dict

param containerProvider:

The container provider associated with the security configuration.

type (string) -- [REQUIRED]

The type of the container provider. Amazon EKS is the only supported type as of now.
id (string) -- [REQUIRED]

The ID of the container cluster.
info (dict) --

The information about the container cluster.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: eksInfo.
- eksInfo (dict) --
  
  The information about the Amazon EKS cluster.
  - namespace (string) --
    
    The namespaces of the Amazon EKS cluster.
  - nodeLabel (string) --
    
    The nodeLabel of the nodes where the resources of this virtual cluster can get scheduled. It requires relevant scaling and policy engine addons.

type securityConfigurationData:

dict

param securityConfigurationData:

[REQUIRED]

Security configuration input for the request.

authorizationConfiguration (dict) --

Authorization-related configuration input for the security configuration.
- lakeFormationConfiguration (dict) --
  
  Lake Formation related configuration inputs for the security configuration.
  - authorizedSessionTagValue (string) --
    
    The session tag to authorize Amazon EMR on EKS for API calls to Lake Formation.
  - secureNamespaceInfo (dict) --
    
    The namespace input of the system job.
    - clusterId (string) --
      
      The ID of the Amazon EKS cluster where Amazon EMR on EKS jobs run.
    - namespace (string) --
      
      The namespace of the Amazon EKS cluster where the system jobs run.
  - queryEngineRoleArn (string) --
    
    The query engine IAM role ARN that is tied to the secure Spark job. The QueryEngine role assumes the JobExecutionRole to execute all the Lake Formation calls.
- encryptionConfiguration (dict) --
  
  Encryption-related configuration input for the security configuration.
  - inTransitEncryptionConfiguration (dict) --
    
    In-transit encryption-related input for the security configuration.
    - tlsCertificateConfiguration (dict) --
      
      TLS certificate-related configuration input for the security configuration.
      - certificateProviderType (string) --
        
        The TLS certificate type. Acceptable values: PEM or Custom.
      - publicCertificateSecretArn (string) --
        
        Secrets Manager ARN that contains the public TLS certificate contents, used for communication between the user job and the system job.
      - privateCertificateSecretArn (string) --
        
        Secrets Manager ARN that contains the private TLS certificate contents, used for communication between the user job and the system job.
authenticationConfiguration (dict) --

Authentication-related configuration input for the security configuration.
- identityCenterConfiguration (dict) --
  
  Identity Center configuration for authentication in the security configuration.
  - enableIdentityCenter (boolean) --
    
    Determines whether Identity Center is enabled for the security configuration.
  - identityCenterApplicationAssignmentRequired (boolean) --
    
    Determines whether user assignment is required for the Identity Center application.
  - identityCenterInstanceARN (string) --
    
    The ARN of the Identity Center instance.
  - emrIdentityCenterApplicationARN (string) --
    
    The ARN of the EMR Identity Center application.
- iamConfiguration (dict) --
  
  IAM configuration for authentication in the security configuration.
  - systemRole (string) --
    
    The ARN of the system role used by the security configuration.

type tags:

dict

param tags:

The tags to add to the security configuration.

(string) --
- (string) --

rtype:

dict

returns:

Response Syntax

{
    'id': 'string',
    'name': 'string',
    'arn': 'string'
}

Response Structure

(dict) --
- id (string) --
  
  The ID of the security configuration.
- name (string) --
  
  The name of the security configuration.
- arn (string) --
  
  The ARN (Amazon Resource Name) of the security configuration.

DescribeSecurityConfiguration (updated)

Link ¶
Changes (response)

{'securityConfiguration': {'securityConfigurationData': {'authenticationConfiguration': {'iamConfiguration': {'systemRole': 'string'},
                                                                                         'identityCenterConfiguration': {'emrIdentityCenterApplicationARN': 'string',
                                                                                                                         'enableIdentityCenter': 'boolean',
                                                                                                                         'identityCenterApplicationAssignmentRequired': 'boolean',
                                                                                                                         'identityCenterInstanceARN': 'string'}}}}}

Displays detailed information about a specified security configuration. Security configurations in Amazon EMR on EKS are templates for different security setups. You can use security configurations to configure the Lake Formation integration setup. You can also create a security configuration to re-use a security setup each time you create a virtual cluster.

See also: AWS API Documentation

Request Syntax

client.describe_security_configuration(
    id='string'
)

type id:

string

param id:

[REQUIRED]

The ID of the security configuration.

rtype:

dict

returns:

Response Syntax

{
    'securityConfiguration': {
        'id': 'string',
        'name': 'string',
        'arn': 'string',
        'createdAt': datetime(2015, 1, 1),
        'createdBy': 'string',
        'securityConfigurationData': {
            'authorizationConfiguration': {
                'lakeFormationConfiguration': {
                    'authorizedSessionTagValue': 'string',
                    'secureNamespaceInfo': {
                        'clusterId': 'string',
                        'namespace': 'string'
                    },
                    'queryEngineRoleArn': 'string'
                },
                'encryptionConfiguration': {
                    'inTransitEncryptionConfiguration': {
                        'tlsCertificateConfiguration': {
                            'certificateProviderType': 'PEM',
                            'publicCertificateSecretArn': 'string',
                            'privateCertificateSecretArn': 'string'
                        }
                    }
                }
            },
            'authenticationConfiguration': {
                'identityCenterConfiguration': {
                    'enableIdentityCenter': True|False,
                    'identityCenterApplicationAssignmentRequired': True|False,
                    'identityCenterInstanceARN': 'string',
                    'emrIdentityCenterApplicationARN': 'string'
                },
                'iamConfiguration': {
                    'systemRole': 'string'
                }
            }
        },
        'tags': {
            'string': 'string'
        }
    }
}

Response Structure

(dict) --
- securityConfiguration (dict) --
  
  Details of the security configuration.
  - id (string) --
    
    The ID of the security configuration.
  - name (string) --
    
    The name of the security configuration.
  - arn (string) --
    
    The ARN (Amazon Resource Name) of the security configuration.
  - createdAt (datetime) --
    
    The date and time that the job run was created.
  - createdBy (string) --
    
    The user who created the job run.
  - securityConfigurationData (dict) --
    
    Security configuration inputs for the request.
    - authorizationConfiguration (dict) --
      
      Authorization-related configuration input for the security configuration.
      - lakeFormationConfiguration (dict) --
        
        Lake Formation related configuration inputs for the security configuration.
        
        authorizedSessionTagValue (string) --
        
        The session tag to authorize Amazon EMR on EKS for API calls to Lake Formation.
        
        secureNamespaceInfo (dict) --
        
        The namespace input of the system job.
        
        clusterId (string) --
        
        The ID of the Amazon EKS cluster where Amazon EMR on EKS jobs run.
        
        namespace (string) --
        
        The namespace of the Amazon EKS cluster where the system jobs run.
        
        queryEngineRoleArn (string) --
        
        The query engine IAM role ARN that is tied to the secure Spark job. The QueryEngine role assumes the JobExecutionRole to execute all the Lake Formation calls.
      - encryptionConfiguration (dict) --
        
        Encryption-related configuration input for the security configuration.
        
        inTransitEncryptionConfiguration (dict) --
        
        In-transit encryption-related input for the security configuration.
        
        tlsCertificateConfiguration (dict) --
        
        TLS certificate-related configuration input for the security configuration.
        
        certificateProviderType (string) --
        
        The TLS certificate type. Acceptable values: PEM or Custom.
        
        publicCertificateSecretArn (string) --
        
        Secrets Manager ARN that contains the public TLS certificate contents, used for communication between the user job and the system job.
        
        privateCertificateSecretArn (string) --
        
        Secrets Manager ARN that contains the private TLS certificate contents, used for communication between the user job and the system job.
    - authenticationConfiguration (dict) --
      
      Authentication-related configuration input for the security configuration.
      - identityCenterConfiguration (dict) --
        
        Identity Center configuration for authentication in the security configuration.
        
        enableIdentityCenter (boolean) --
        
        Determines whether Identity Center is enabled for the security configuration.
        
        identityCenterApplicationAssignmentRequired (boolean) --
        
        Determines whether user assignment is required for the Identity Center application.
        
        identityCenterInstanceARN (string) --
        
        The ARN of the Identity Center instance.
        
        emrIdentityCenterApplicationARN (string) --
        
        The ARN of the EMR Identity Center application.
      - iamConfiguration (dict) --
        
        IAM configuration for authentication in the security configuration.
        
        systemRole (string) --
        
        The ARN of the system role used by the security configuration.
  - tags (dict) --
    
    The tags to assign to the security configuration.
    - (string) --
      - (string) --

ListSecurityConfigurations (updated)

Link ¶
Changes (response)

{'securityConfigurations': {'securityConfigurationData': {'authenticationConfiguration': {'iamConfiguration': {'systemRole': 'string'},
                                                                                          'identityCenterConfiguration': {'emrIdentityCenterApplicationARN': 'string',
                                                                                                                          'enableIdentityCenter': 'boolean',
                                                                                                                          'identityCenterApplicationAssignmentRequired': 'boolean',
                                                                                                                          'identityCenterInstanceARN': 'string'}}}}}

Lists security configurations based on a set of parameters. Security configurations in Amazon EMR on EKS are templates for different security setups. You can use security configurations to configure the Lake Formation integration setup. You can also create a security configuration to re-use a security setup each time you create a virtual cluster.

See also: AWS API Documentation

Request Syntax

client.list_security_configurations(
    createdAfter=datetime(2015, 1, 1),
    createdBefore=datetime(2015, 1, 1),
    maxResults=123,
    nextToken='string'
)

type createdAfter:

datetime

param createdAfter:

The date and time after which the security configuration was created.

type createdBefore:

datetime

param createdBefore:

The date and time before which the security configuration was created.

type maxResults:

integer

param maxResults:

The maximum number of security configurations the operation can list.

type nextToken:

string

param nextToken:

The token for the next set of security configurations to return.

rtype:

dict

returns:

Response Syntax

{
    'securityConfigurations': [
        {
            'id': 'string',
            'name': 'string',
            'arn': 'string',
            'createdAt': datetime(2015, 1, 1),
            'createdBy': 'string',
            'securityConfigurationData': {
                'authorizationConfiguration': {
                    'lakeFormationConfiguration': {
                        'authorizedSessionTagValue': 'string',
                        'secureNamespaceInfo': {
                            'clusterId': 'string',
                            'namespace': 'string'
                        },
                        'queryEngineRoleArn': 'string'
                    },
                    'encryptionConfiguration': {
                        'inTransitEncryptionConfiguration': {
                            'tlsCertificateConfiguration': {
                                'certificateProviderType': 'PEM',
                                'publicCertificateSecretArn': 'string',
                                'privateCertificateSecretArn': 'string'
                            }
                        }
                    }
                },
                'authenticationConfiguration': {
                    'identityCenterConfiguration': {
                        'enableIdentityCenter': True|False,
                        'identityCenterApplicationAssignmentRequired': True|False,
                        'identityCenterInstanceARN': 'string',
                        'emrIdentityCenterApplicationARN': 'string'
                    },
                    'iamConfiguration': {
                        'systemRole': 'string'
                    }
                }
            },
            'tags': {
                'string': 'string'
            }
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- securityConfigurations (list) --
  
  The list of returned security configurations.
  - (dict) --
    
    Inputs related to the security configuration. Security configurations in Amazon EMR on EKS are templates for different security setups. You can use security configurations to configure the Lake Formation integration setup. You can also create a security configuration to re-use a security setup each time you create a virtual cluster.
    - id (string) --
      
      The ID of the security configuration.
    - name (string) --
      
      The name of the security configuration.
    - arn (string) --
      
      The ARN (Amazon Resource Name) of the security configuration.
    - createdAt (datetime) --
      
      The date and time that the job run was created.
    - createdBy (string) --
      
      The user who created the job run.
    - securityConfigurationData (dict) --
      
      Security configuration inputs for the request.
      - authorizationConfiguration (dict) --
        
        Authorization-related configuration input for the security configuration.
        
        lakeFormationConfiguration (dict) --
        
        Lake Formation related configuration inputs for the security configuration.
        
        authorizedSessionTagValue (string) --
        
        The session tag to authorize Amazon EMR on EKS for API calls to Lake Formation.
        
        secureNamespaceInfo (dict) --
        
        The namespace input of the system job.
        
        clusterId (string) --
        
        The ID of the Amazon EKS cluster where Amazon EMR on EKS jobs run.
        
        namespace (string) --
        
        The namespace of the Amazon EKS cluster where the system jobs run.
        
        queryEngineRoleArn (string) --
        
        The query engine IAM role ARN that is tied to the secure Spark job. The QueryEngine role assumes the JobExecutionRole to execute all the Lake Formation calls.
        
        encryptionConfiguration (dict) --
        
        Encryption-related configuration input for the security configuration.
        
        inTransitEncryptionConfiguration (dict) --
        
        In-transit encryption-related input for the security configuration.
        
        tlsCertificateConfiguration (dict) --
        
        TLS certificate-related configuration input for the security configuration.
        
        certificateProviderType (string) --
        
        The TLS certificate type. Acceptable values: PEM or Custom.
        
        publicCertificateSecretArn (string) --
        
        Secrets Manager ARN that contains the public TLS certificate contents, used for communication between the user job and the system job.
        
        privateCertificateSecretArn (string) --
        
        Secrets Manager ARN that contains the private TLS certificate contents, used for communication between the user job and the system job.
      - authenticationConfiguration (dict) --
        
        Authentication-related configuration input for the security configuration.
        
        identityCenterConfiguration (dict) --
        
        Identity Center configuration for authentication in the security configuration.
        
        enableIdentityCenter (boolean) --
        
        Determines whether Identity Center is enabled for the security configuration.
        
        identityCenterApplicationAssignmentRequired (boolean) --
        
        Determines whether user assignment is required for the Identity Center application.
        
        identityCenterInstanceARN (string) --
        
        The ARN of the Identity Center instance.
        
        emrIdentityCenterApplicationARN (string) --
        
        The ARN of the EMR Identity Center application.
        
        iamConfiguration (dict) --
        
        IAM configuration for authentication in the security configuration.
        
        systemRole (string) --
        
        The ARN of the system role used by the security configuration.
    - tags (dict) --
      
      The tags to assign to the security configuration.
      - (string) --
        
        (string) --
- nextToken (string) --
  
  The token for the next set of security configurations to return.