AWS IAM Policy Resource declaration for EMR - amazon-iam

Question

I am reading up on creating IAM policies for EMR and am a little confused on the use of the Resource: section in the JSON declaration.
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-fine-grained-cluster-access.html
For instance in the below example the use of * would imply all resources in the AWS account, but since the specific permission is elasticmapreduce:CreateEditor does that really just imply that it ends up only affecting the editor resource in EMR assuming the conditional block is satisfied?
In the below link there is a resource type definition that for the editor arn:${Partition}:elasticmapreduce:${Region}:${Account}:editor/${EditorId}.
Would resource:* essentially equal arn:${Partition}:elasticmapreduce:${Region}:${Account}:editor/*?
https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticmapreduce.html#amazonelasticmapreduce-studio
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"elasticmapreduce:CreateEditor"
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"StringEquals": {
"elasticmapreduce:RequestTag/creatorUserId": "${aws:userid}"
}
}
}
]
}
Another area of confusion is that in this example below there is a specific resource type declared. Why isn't Resource:* used here? I see in my second link that the StartEditor permission has a required resource type of cluster or editor but wouldn't Resource:* and the use of elasticmapreduce:StartEditor be specific enough to mimic how elasticmapreduce:CreateEditor can use Resource:*?
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"elasticmapreduce:StartEditor"
],
"Effect": "Allow",
"Resource": "arn:aws:elasticmapreduce:*:123456789012:editor/*",
"Condition": {
"StringEquals": {
"elasticmapreduce:ResourceTag/owner": [
"owner1",
"owner2"
]
}
}
}
]
}

Answer 1

There are a few things going on here, I will reply to your questions in order:
since the specific permission is elasticmapreduce:CreateEditor does that really just imply that it ends up only affecting the editor resource in EMR assuming the conditional block is satisfied?
The CreateEditor action only applies to the Resource Type cluster*, so with it, you basically restrict for which clusters the IAM entity can create an editor. It would not make sense to be able to restrict CreateEditor to a specific editor since that editor would not yet exist. That also means that resource:* doesnt equal rn:${Partition}:elasticmapreduce:${Region}:${Account}:editor/* in this case since it only applies to clusters.
Another area of confusion is that in this example below there is a specific resource type declared. Why isn't Resource:* used here?
In your second example the goal is explicitly to only allow access to editors that have a specific "owner" tag. Putting Resource:* in that policy would also extend the tag requirement to clusters (since elasticmapreduce:StartEditor can apply to both clusters and editors). That would mean that both the editor and the cluster would need to have the tag for the IAM entity to be able to start the editor.
As you can see in the two examples that follow your second code in your link (section Limit the ability to start a notebook based on tags), the example is then extended to specify a different tag requirement for the cluster.