Why Can't I Submit Jobs on the Console After My IAM Account Is Assigned with MRS Permissions?

Question:

Why can't I submit jobs on the MRS console after my IAM account is assigned with the MRS ReadOnlyAccess and MRS FullAccess permissions?

Answer:

The account has the MRS ReadOnlyAccess and MRS FullAccess permissions. Due to the permission priority, the account cannot add jobs on the MRS console.

The group to which the IAM account belongs has the MRS FullAccess, MRS ReadOnlyAccess, and MRS Administrator permissions. MRS FullAccess and MRS ReadOnlyAccess are fine-grained permissions, and MRS Administrator is a role-based access control (RBAC) policy. Fine-grained permissions have higher priorities over RBAC policies. If fine-grained permissions and RBAC policies are configured, fine-grained permissions take effect first. Fine-grained permissions follow the deny priority principle. Therefore, the MRS ReadOnlyAccess permission takes effect finally. So, a message is displayed, indicating that the account does not have the permission.

Delete the MRS ReadOnlyAccess permission, log out of the console, and log in to the console again.