Manage AWS EMR EC2 clusters with comprehensive control over cluster lifecycle. This tool provides operations for managing Amazon EMR clusters running on EC2 instances, including creating, configuring, monitoring, modifying, and terminating clusters. It also supports security configuration manage...
High parameter count (36 properties); Single-target operation; Admin/system-level operation
Part of the Amazon Data Processing MCP Server MCP server. Enforce policies on this tool with Intercept, the open-source MCP proxy.
AI agents use manage_aws_emr_clusters to create or modify resources in Amazon Data Processing MCP Server. Write operations carry medium risk because an autonomous agent could trigger bulk unintended modifications. Rate limits prevent a single agent session from making hundreds of changes in rapid succession. Argument validation ensures the agent passes expected values.
Without a policy, an AI agent could call manage_aws_emr_clusters repeatedly, creating or modifying resources faster than any human could review. Intercept's rate limiting ensures write operations happen at a controlled pace, and argument validation catches malformed or unexpected inputs before they reach Amazon Data Processing MCP Server.
Write tools can modify data. A rate limit prevents runaway bulk operations from AI agents.
tools:
manage_aws_emr_clusters:
rules:
- action: allow
rate_limit:
max: 30
window: 60See the full Amazon Data Processing MCP Server policy for all 36 tools.
Agents calling write-class tools like manage_aws_emr_clusters have been implicated in these attack patterns. Read the full case and prevention policy for each:
Other tools in the Write risk category across the catalogue. The same policy patterns (rate-limit, validate) apply to each.
Manage AWS EMR EC2 clusters with comprehensive control over cluster lifecycle. This tool provides operations for managing Amazon EMR clusters running on EC2 instances, including creating, configuring, monitoring, modifying, and terminating clusters. It also supports security configuration management for EMR clusters. ## Requirements - The server must be run with the `--allow-write` flag for create-cluster, modify-cluster, modify-cluster-attributes, terminate-clusters, create-security-configuration, and delete-security-configuration operations - Appropriate AWS permissions for EMR cluster operations ## Operations - **create-cluster**: Create a new EMR cluster with specified configurations - **describe-cluster**: Get detailed information about a specific EMR cluster - **modify-cluster**: Modify the step concurrency level of a running cluster - **modify-cluster-attributes**: Modify auto-termination and termination protection settings - **terminate-clusters**: Terminate one or more EMR clusters - **list-clusters**: List all EMR clusters with optional filtering - **create-security-configuration**: Create a new EMR security configuration - **delete-security-configuration**: Delete an existing EMR security configuration - **describe-security-configuration**: Get details about a specific security configuration - **list-security-configurations**: List all available security configurations ## Example ``` # Create a basic EMR cluster with Spark { 'operation': 'create-cluster', 'name': 'SparkCluster', 'release_label': 'emr-7.9.0', 'applications': [{'Name': 'Spark'}], 'instances': { 'InstanceGroups': [ { 'Name': 'Master', 'InstanceRole': 'MASTER', 'InstanceType': 'm5.xlarge', 'InstanceCount': 1, }, { 'Name': 'Core', 'InstanceRole': 'CORE', 'InstanceType': 'm5.xlarge', 'InstanceCount': 2, }, ], 'Ec2KeyName': 'my-key-pair', 'KeepJobFlowAliveWhenNoSteps': true, }, } ``` ## Usage Tips - Use list-clusters to find cluster IDs before performing operations on specific clusters - Check cluster state before performing operations that require specific states - For large result sets, use pagination with marker parameter - When creating clusters, consider using security configurations for encryption and authentication Args: ctx: MCP context operation: Operation to perform cluster_id: ID of the EMR cluster cluster_ids: List of EMR cluster IDs name: Name of the EMR cluster log_uri: The path to the Amazon S3 location where logs for the cluster are stored log_encryption_kms_key_id: The KMS key used for encrypting log files release_label: The Amazon EMR release label applications: The applications to be installed on the cluster instances: A specification of the number and type of Amazon EC2 instances steps: A list of steps to run on the cluster bootstrap_actions: A list of bootstrap actions to run on the cluster configurations: A list of configurations to apply to the cluster visible_to_all_users: Whether the cluster is visible to all IAM users of the AWS account service_role: The IAM role that Amazon EMR assumes to access AWS resources on your behalf job_flow_role: The IAM role for EC2 instances running the job flow (required for create-cluster when using temporary credentials). Also known as the EC2 instance profile. security_configuration: The name of a security configuration to apply to the cluster auto_scaling_role: An IAM role for automatic scaling policies scale_down_behavior: The way that individual Amazon EC2 instances terminate when an automatic scale-in activity occurs custom_ami_id: A custom Amazon Linux AMI for the cluster ebs_root_volume_size: The size, in GiB, of the EBS root device volume of the Linux AMI ebs_root_volume_iops: The IOPS of the EBS root device volume of the Linux AMI ebs_root_volume_throughput: The throughput, in MiB/s, of the EBS root device volume of the Linux AMI repo_upgrade_on_boot: Specifies the type of updates that are applied from the Amazon Linux AMI package repositories when an instance boots kerberos_attributes: Attributes for Kerberos configuration when Kerberos authentication is enabled step_concurrency_level: The number of steps that can be executed concurrently auto_terminate: Whether the cluster should auto-terminate after completing steps termination_protected: Whether the cluster is protected from termination unhealthy_node_replacement: Whether Amazon EMR should gracefully replace Amazon EC2 core instances that have degraded within the cluster os_release_label: The Amazon Linux release for the cluster placement_groups: Placement group configuration for the cluster cluster_states: The cluster state filters to apply when listing clusters created_after: The creation date and time beginning value filter for listing clusters created_before: The creation date and time end value filter for listing clusters marker: The pagination token for list-clusters operation security_configuration_name: Name of the security configuration security_configuration_json: JSON format security configuration Returns: Union of response types specific to the operation performed. It is categorised as a Write tool in the Amazon Data Processing MCP Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Add a rule in your Intercept YAML policy under the tools section for manage_aws_emr_clusters. You can allow, deny, rate-limit, or validate arguments. Then run Intercept as a proxy in front of the Amazon Data Processing MCP Server MCP server.
manage_aws_emr_clusters is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the manage_aws_emr_clusters rule in your Intercept policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the Intercept policy for manage_aws_emr_clusters. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
manage_aws_emr_clusters is provided by the Amazon Data Processing MCP Server MCP server (awslabs.aws-dataprocessing-mcp-server). Intercept sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic policy on every MCP tool call. Per-identity grants. Full audit log.