EMR account has Block Public Access enabled

# Enable EMR Block Public Access (account/Region level)
resource "aws_emr_block_public_access_configuration" "example_resource_name" {
  block_public_security_group_rules = true  # CRITICAL: enables Block Public Access
}

# CloudFormation: Enable EMR Block Public Access (account/Region level)
Resources:
  EmrBpaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EmrBpaPut
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: elasticmapreduce:PutBlockPublicAccessConfiguration
                Resource: "*"

  EmrBpaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt EmrBpaRole.Arn
      Runtime: python3.12
      Handler: index.handler
      Code:
        ZipFile: |
          import boto3, json, urllib.request
          def handler(event, context):
              try:
                  boto3.client('emr').put_block_public_access_configuration(
                      BlockPublicAccessConfiguration={
                          'BlockPublicSecurityGroupRules': True  # CRITICAL: enables EMR Block Public Access
                      }
                  )
                  status='SUCCESS'
              except Exception:
                  status='FAILED'
              body=json.dumps({
                  'Status': status,
                  'PhysicalResourceId': 'EmrBPA',  # respond to CFN
                  'StackId': event['StackId'],
                  'RequestId': event['RequestId'],
                  'LogicalResourceId': event['LogicalResourceId']
              }).encode()
              req=urllib.request.Request(event['ResponseURL'], data=body, method='PUT')
              req.add_header('content-type','')
              req.add_header('content-length',str(len(body)))
              urllib.request.urlopen(req)

  EmrBpa:
    Type: Custom::EmrBpa
    Properties:
      ServiceToken: !GetAtt EmrBpaFunction.Arn  # Invokes Lambda to apply the setting