Tagging WAL workspaces

You can add tags to a workspace when you create a new workspace and you can add, remove, or list tags from an active workspace for a running cluster. You can't tag the individual resources in the workspace, and you can't update existing tags; instead, remove unwanted tags from the workspace and replace them.

You can tag workspaces from the EMRWAL CLI. For a list of EMRWAL CLI commands for tagging workspaces, see Amazon EMR WAL (EMRWAL) CLI reference.

The following example IAM policy illustrates a scenario that allows workspace CRUDL operations only with the proper tagging key resource_tag_allow_test_key and value resource_tag_allow_test_value:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Action": [
              "EMRWAL:*"
          ],
          "Effect": "Allow",
          "Resource": [
              "*",
              "*"
          ],
          "Condition": {
              "StringEquals": {
                  "aws:ResourceTag/resource_tag_allow_test_key": [
                      "resource_tag_allow_test_value"
                  ]
              }
          }
      }
  ]
}

To verify that the tag is now required for workspace operations, use the Amazon EMR WAL (EMRWAL) CLI reference to call the listTagsForResource command on tagAllowResourceTag for the workspace with the desired resource tag. If you configured the condition correctly, the command will succeed.

emrwal listTagsForResource -r us-east-1 -arn arn:aws:emrwal:us-east-1:arn:workspace/tagAllowResourceTag
Tag(Key=resource_tag_allow_test_key, Value=resource_tag_allow_test_value)