studios

Creates, updates, deletes or gets a studio resource or lists studios in a region

Overview

Name	studios
Type	Resource
Description	Resource schema for AWS::EMR::Studio
Id	aws.emr.studios

Fields

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the EMR Studio.
auth_mode	string	Specifies whether the Studio authenticates users using single sign-on (SSO) or IAM. Amazon EMR Studio currently only supports SSO authentication.
default_s3_location	string	The default Amazon S3 location to back up EMR Studio Workspaces and notebook files. A Studio user can select an alternative Amazon S3 location when creating a Workspace.
description	string	A detailed description of the Studio.
engine_security_group_id	string	The ID of the Amazon EMR Studio Engine security group. The Engine security group allows inbound network traffic from the Workspace security group, and it must be in the same VPC specified by VpcId.
name	string	A descriptive name for the Amazon EMR Studio.
service_role	string	The IAM role that will be assumed by the Amazon EMR Studio. The service role provides a way for Amazon EMR Studio to interoperate with other AWS services.
studio_id	string	The ID of the EMR Studio.
subnet_ids	array	A list of up to 5 subnet IDs to associate with the Studio. The subnets must belong to the VPC specified by VpcId. Studio users can create a Workspace in any of the specified subnets.
tags	array	A list of tags to associate with the Studio. Tags are user-defined key-value pairs that consist of a required key string with a maximum of 128 characters, and an optional value string with a maximum of 256 characters.
url	string	The unique Studio access URL.
user_role	string	The IAM user role that will be assumed by users and groups logged in to a Studio. The permissions attached to this IAM role can be scoped down for each user or group using session policies.
vpc_id	string	The ID of the Amazon Virtual Private Cloud (Amazon VPC) to associate with the Studio.
workspace_security_group_id	string	The ID of the Amazon EMR Studio Workspace security group. The Workspace security group allows outbound network traffic to resources in the Engine security group, and it must be in the same VPC specified by VpcId.
idp_auth_url	string	Your identity provider's authentication endpoint. Amazon EMR Studio redirects federated users to this endpoint for authentication when logging in to a Studio with the Studio URL.
idp_relay_state_parameter_name	string	The name of relay state parameter for external Identity Provider.
trusted_identity_propagation_enabled	boolean	A Boolean indicating whether to enable Trusted identity propagation for the Studio. The default value is false.
idc_user_assignment	string	Specifies whether IAM Identity Center user assignment is REQUIRED or OPTIONAL. If the value is set to REQUIRED, users must be explicitly assigned to the Studio application to access the Studio.
idc_instance_arn	string	The ARN of the IAM Identity Center instance to create the Studio application.
encryption_key_arn	string	The AWS KMS key identifier (ARN) used to encrypt AWS EMR Studio workspace and notebook files when backed up to AWS S3.
region	string	AWS region.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	AuthMode, EngineSecurityGroupId, Name, ServiceRole, SubnetIds, VpcId, WorkspaceSecurityGroupId, DefaultS3Location, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all studios in a region.

SELECT
region,
arn,
auth_mode,
default_s3_location,
description,
engine_security_group_id,
name,
service_role,
studio_id,
subnet_ids,
tags,
url,
user_role,
vpc_id,
workspace_security_group_id,
idp_auth_url,
idp_relay_state_parameter_name,
trusted_identity_propagation_enabled,
idc_user_assignment,
idc_instance_arn,
encryption_key_arn
FROM aws.emr.studios
WHERE region = 'us-east-1';

Gets all properties from an individual studio.

SELECT
region,
arn,
auth_mode,
default_s3_location,
description,
engine_security_group_id,
name,
service_role,
studio_id,
subnet_ids,
tags,
url,
user_role,
vpc_id,
workspace_security_group_id,
idp_auth_url,
idp_relay_state_parameter_name,
trusted_identity_propagation_enabled,
idc_user_assignment,
idc_instance_arn,
encryption_key_arn
FROM aws.emr.studios
WHERE region = 'us-east-1' AND data__Identifier = '<StudioId>';

INSERT example

Use the following StackQL query and manifest file to create a new studio resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.emr.studios (
 AuthMode,
 DefaultS3Location,
 EngineSecurityGroupId,
 Name,
 ServiceRole,
 SubnetIds,
 VpcId,
 WorkspaceSecurityGroupId,
 region
)
SELECT 
'{{ AuthMode }}',
 '{{ DefaultS3Location }}',
 '{{ EngineSecurityGroupId }}',
 '{{ Name }}',
 '{{ ServiceRole }}',
 '{{ SubnetIds }}',
 '{{ VpcId }}',
 '{{ WorkspaceSecurityGroupId }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.emr.studios (
 AuthMode,
 DefaultS3Location,
 Description,
 EngineSecurityGroupId,
 Name,
 ServiceRole,
 SubnetIds,
 Tags,
 UserRole,
 VpcId,
 WorkspaceSecurityGroupId,
 IdpAuthUrl,
 IdpRelayStateParameterName,
 TrustedIdentityPropagationEnabled,
 IdcUserAssignment,
 IdcInstanceArn,
 EncryptionKeyArn,
 region
)
SELECT 
 '{{ AuthMode }}',
 '{{ DefaultS3Location }}',
 '{{ Description }}',
 '{{ EngineSecurityGroupId }}',
 '{{ Name }}',
 '{{ ServiceRole }}',
 '{{ SubnetIds }}',
 '{{ Tags }}',
 '{{ UserRole }}',
 '{{ VpcId }}',
 '{{ WorkspaceSecurityGroupId }}',
 '{{ IdpAuthUrl }}',
 '{{ IdpRelayStateParameterName }}',
 '{{ TrustedIdentityPropagationEnabled }}',
 '{{ IdcUserAssignment }}',
 '{{ IdcInstanceArn }}',
 '{{ EncryptionKeyArn }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: studio
    props:
      - name: AuthMode
        value: '{{ AuthMode }}'
      - name: DefaultS3Location
        value: '{{ DefaultS3Location }}'
      - name: Description
        value: '{{ Description }}'
      - name: EngineSecurityGroupId
        value: '{{ EngineSecurityGroupId }}'
      - name: Name
        value: '{{ Name }}'
      - name: ServiceRole
        value: '{{ ServiceRole }}'
      - name: SubnetIds
        value:
          - '{{ SubnetIds[0] }}'
      - name: Tags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'
      - name: UserRole
        value: null
      - name: VpcId
        value: '{{ VpcId }}'
      - name: WorkspaceSecurityGroupId
        value: '{{ WorkspaceSecurityGroupId }}'
      - name: IdpAuthUrl
        value: '{{ IdpAuthUrl }}'
      - name: IdpRelayStateParameterName
        value: '{{ IdpRelayStateParameterName }}'
      - name: TrustedIdentityPropagationEnabled
        value: '{{ TrustedIdentityPropagationEnabled }}'
      - name: IdcUserAssignment
        value: '{{ IdcUserAssignment }}'
      - name: IdcInstanceArn
        value: '{{ IdcInstanceArn }}'
      - name: EncryptionKeyArn
        value: null

DELETE example

/*+ delete */
DELETE FROM aws.emr.studios
WHERE data__Identifier = '<StudioId>'
AND region = 'us-east-1';

Permissions

To operate on the studios resource, the following permissions are required:

Create

elasticmapreduce:CreateStudio,
elasticmapreduce:DescribeStudio,
elasticmapreduce:AddTags,
sso:CreateManagedApplicationInstance,
sso:DeleteManagedApplicationInstance,
iam:PassRole

Read

elasticmapreduce:DescribeStudio,
sso:GetManagedApplicationInstance

Update

elasticmapreduce:UpdateStudio,
elasticmapreduce:DescribeStudio,
elasticmapreduce:AddTags,
elasticmapreduce:RemoveTags

Delete

elasticmapreduce:DeleteStudio,
elasticmapreduce:DescribeStudio,
sso:DeleteManagedApplicationInstance

List

elasticmapreduce:ListStudios