Studio submodule

Input and output reference for the EMR Studio submodule.

Inputs

General

create · bool · default: "true"

Controls if resources should be created (affects nearly all resources).

region · string · default: "null"

Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration.

tags · map(string) · default: "{}"

A map of tags to add to all resources.

Studio

name · string · default: "\"\""

A descriptive name for the Amazon EMR Studio.

description · string · default: "null"

A detailed description of the Amazon EMR Studio.

auth_mode · string · default: "\"IAM\""

Specifies whether the Studio authenticates users using IAM or Amazon Web Services SSO. Valid values are SSO or IAM.

default_s3_location · string · default: "\"\""

The Amazon S3 location to back up Amazon EMR Studio Workspaces and notebook files.

encryption_key_arn · string · default: "null"

The AWS KMS key identifier (ARN) used to encrypt Amazon EMR Studio workspace and notebook files when backed up to Amazon S3.

vpc_id · string · default: "\"\""

The ID of the Amazon Virtual Private Cloud (Amazon VPC) to associate with the Studio.

subnet_ids · list(string) · default: "[]"

A list of subnet IDs to associate with the Amazon EMR Studio. A Studio can have a maximum of 5 subnets. The subnets must belong to the VPC specified by vpc_id.

idp_auth_url · string · default: "null"

The authentication endpoint of your identity provider (IdP). Specify this value when you use IAM authentication and want to let federated users log in to a Studio with the Studio URL and credentials from your IdP.

idp_relay_state_parameter_name · string · default: "null"

The name that your identity provider (IdP) uses for its RelayState parameter. For example, RelayState or TargetSource.

session_mappings · map(object) · default: "null"

A map of session mapping definitions to apply to the Studio. Each entry accepts:

• identity_type (string, required)
• identity_id (optional string)
• identity_name (optional string)
• session_policy_arn (optional string)

Service IAM role

create_service_role · bool · default: "true"

Determines whether the service IAM role should be created.

service_role_arn · string · default: "null"

The ARN of an existing IAM role to use for the service.

service_role_name · string · default: "null"

Name to use on the IAM role created.

service_role_use_name_prefix · bool · default: "true"

Determines whether the IAM role name is used as a prefix.

service_role_description · string · default: "null"

Description of the role.

service_role_path · string · default: "null"

IAM role path.

service_role_permissions_boundary · string · default: "null"

ARN of the policy that is used to set the permissions boundary for the IAM role.

service_role_policies · map(string) · default: "{}"

Map of IAM policies to attach to the service role.

service_role_tags · map(string) · default: "{}"

A map of additional tags to add to the IAM role created.

Service IAM role policy

create_service_role_policy · bool · default: "true"

Determines whether the service IAM role policy should be created.

service_role_secrets_manager_arns · list(string) · default: "[]"

A list of Amazon Web Services Secrets Manager secret ARNs to allow use of Git credentials stored in AWS Secrets Manager to link Git repositories to a Workspace.

service_role_s3_bucket_arns · list(string) · default: "[]"

A list of Amazon S3 bucket ARNs to allow permission to read/write from the Amazon EMR Studio.

service_role_statements · map(object) · default: "null"

A map of IAM policy statements for custom permission usage. Each entry accepts sid, actions, not_actions, effect, resources, not_resources, principals, not_principals, and condition.

User IAM role

create_user_role · bool · default: "true"

Determines whether the user IAM role should be created.

user_role_arn · string · default: "null"

The ARN of an existing IAM role to use for the user.

user_role_name · string · default: "null"

Name to use on the IAM role created.

user_role_use_name_prefix · bool · default: "true"

Determines whether the IAM role name is used as a prefix.

user_role_description · string · default: "null"

Description of the role.

user_role_path · string · default: "null"

IAM role path.

user_role_permissions_boundary · string · default: "null"

ARN of the policy that is used to set the permissions boundary for the IAM role.

user_role_policies · map(string) · default: "{}"

Map of IAM policies to attach to the user role.

user_role_tags · map(string) · default: "{}"

A map of additional tags to add to the IAM role created.

User IAM role policy

create_user_role_policy · bool · default: "true"

Determines whether the user IAM role policy should be created.

user_role_s3_bucket_arns · list(string) · default: "[]"

A list of Amazon S3 bucket ARNs to allow permission to read/write from the Amazon EMR Studio user role.

user_role_statements · map(object) · default: "null"

A map of IAM policy statements for custom permission usage. Each entry accepts sid, actions, not_actions, effect, resources, not_resources, principals, not_principals, and condition.

Security groups

create_security_groups · bool · default: "true"

Determines whether security groups for the EMR Studio engine and workspace are created.

security_group_name · string · default: "null"

Name to use on security group created. Note: -engine and -workspace will be appended to this name to distinguish.

security_group_use_name_prefix · bool · default: "true"

Determines whether the security group name (security_group_name) is used as a prefix.

security_group_tags · map(string) · default: "{}"

A map of additional tags to add to the security groups created.

Engine security group

engine_security_group_id · string · default: "null"

The ID of the Amazon EMR Studio Engine security group. The Engine security group allows inbound network traffic from the Workspace security group, and it must be in the same VPC specified by vpc_id.

engine_security_group_description · string · default: "\"EMR Studio engine security group\""

Description of the engine security group created.

engine_security_group_ingress_rules · map(object) · default: "null"

Security group ingress rules to add to the engine security group. Each rule accepts cidr_ipv4, cidr_ipv6, description, from_port, to_port, ip_protocol, prefix_list_id, referenced_security_group_id, referenced_workspace_security_group_id, name, and tags.

engine_security_group_egress_rules · map(object)

Security group egress rules to add to the engine security group. Each rule accepts the same fields as ingress rules.

Workspace security group

workspace_security_group_id · string · default: "null"

The ID of the Amazon EMR Studio Workspace security group. The Workspace security group allows outbound network traffic to resources in the Engine security group, and it must be in the same VPC specified by vpc_id.

workspace_security_group_description · string · default: "\"EMR Studio workspace security group\""

Description of the workspace security group created.

workspace_security_group_ingress_rules · map(object) · default: "null"

Security group ingress rules to add to the workspace security group. Each rule accepts cidr_ipv4, cidr_ipv6, description, from_port, to_port, ip_protocol, prefix_list_id, referenced_security_group_id, referenced_engine_security_group_id, name, and tags.

workspace_security_group_egress_rules · map(object) · default: "null"

Security group egress rules to add to the workspace security group. Each rule accepts the same fields as ingress rules.

---

Outputs

Studio

arn · string

ARN of the studio.

url · string

The unique access URL of the Amazon EMR Studio.

Service IAM role

service_iam_role_name · string

Service IAM role name.

service_iam_role_arn · string

Service IAM role ARN.

service_iam_role_unique_id · string

Stable and unique string identifying the service IAM role.

Service IAM role policy

service_iam_role_policy_arn · string

Service IAM role policy ARN.

service_iam_role_policy_id · string

Service IAM role policy ID.

service_iam_role_policy_name · string

The name of the service role policy.

User IAM role

user_iam_role_name · string

User IAM role name.

user_iam_role_arn · string

User IAM role ARN.

user_iam_role_unique_id · string

Stable and unique string identifying the user IAM role.

User IAM role policy

user_iam_role_policy_arn · string

User IAM role policy ARN.

user_iam_role_policy_id · string

User IAM role policy ID.

user_iam_role_policy_name · string

The name of the user role policy.

Engine security group

engine_security_group_arn · string

Amazon Resource Name (ARN) of the engine security group.

engine_security_group_id · string

ID of the engine security group.

Workspace security group

workspace_security_group_arn · string

Amazon Resource Name (ARN) of the workspace security group.

workspace_security_group_id · string

ID of the workspace security group.