Check ID: emr_cluster_master_nodes_no_public_ip
Provider: AWS
Service: emr
Severity: MEDIUM
Categories: internet-exposed
Resource type: Other

​
What this check verifies

Amazon EMR clusters in non-terminated states are assessed for public IP assignment on cluster nodes (primary and workers). The finding identifies clusters whose instances are reachable via public IPs rather than private VPC addresses.

​
Risk

Publicly reachable EMR nodes expose admin UIs and SSH to the Internet, enabling brute force and service exploits. A compromised primary node can alter jobs and exfiltrate data from S3/HDFS, degrading confidentiality and integrity, and disrupt workloads, impacting availability.

​
Recommendation

Run EMR in private subnets without public IPs. Use VPC endpoints for AWS services and NAT only when needed. Enforce least privilege security groups, avoid 0.0.0.0/0, and prefer SSM or a bastion for admin access. Keep EMR block public access enabled and favor private connectivity for external dependencies.

​
Remediation

# Terraform: Launch EMR in a private subnet (no public IPs)
resource "aws_emr_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  release_label       = "emr-6.10.0"
  master_instance_type = "m5.xlarge"
  core_instance_type   = "m5.xlarge"

  service_role = "EMR_DefaultRole"
  ec2_attributes {
    instance_profile = "EMR_EC2_DefaultRole"
    subnet_id        = "<example_resource_id>"  # CRITICAL: private subnet ensures no public IPs
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = emr_cluster_master_nodes_no_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks