Check ID: emr_cluster_publicly_accesible
Provider: AWS
Service: emr
Severity: MEDIUM
Categories: internet-exposed
Resource type: Other

​
What this check verifies

Amazon EMR clusters are assessed for public network exposure by examining master and core/task node security groups for inbound rules that allow any source (0.0.0.0/0 or ::/0). Only active clusters are considered, and findings identify exposure via the specific security groups attached to the cluster nodes.

​
Risk

Open Internet ingress to EMR nodes enables direct access to services and UIs, facilitating brute force, RCE, and data theft. Adversaries can pivot inside the VPC, alter jobs and outputs (integrity), exfiltrate datasets (confidentiality), or abuse compute for mining, degrading availability.

​
Recommendation

Apply least privilege and defense in depth:
  • Place clusters in private subnets; avoid public IPs
  • Deny 0.0.0.0/0 and ::/0 in node security groups; allow trusted CIDRs only
  • Keep EMR Block Public Access enabled with minimal exceptions
  • Use bastion/SSM, private connectivity, and logging for hardened access

​
Remediation

# Restrict EMR SG ingress to avoid 0.0.0.0/0 or ::/0
resource "aws_security_group_rule" "<example_resource_name>" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  security_group_id = "<example_resource_id>"  # EMR master/core SG
  cidr_blocks       = ["10.0.0.0/8"]           # CRITICAL: restrict source; not 0.0.0.0/0 or ::/0
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = emr_cluster_publicly_accesible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks