lacework-global-392

Amazon Elastic Map Reduce (EMR) cluster primary nodes should not have public IP addresses (Automated)

Description

You can assign public IP addresses in the PublicIp field of the NetworkInterfaces configuration for the instance. This control only checks Amazon EMR clusters that are in a RUNNING or WAITING state

Remediation

note

You can not update existing clusters to remove the public IP address, instead, to remediate, you need to launch a new cluster.

From the AWS Console:

1. Log in to the AWS Management Console.
2. Click Services.
3. Select Analytics > EMR.
4. Under EMR on EC2, click Clusters.
5. Click Create cluster.
6. Under Networking, for the Virtual Private Cloud (VPC) field, select either an existing VPC without a public IP assigned, or create a new one.
7. Make any additional configuration changes.
8. Click Create cluster.

From CLI:

aws elasticache modify-cache-cluster --cache-cluster-id <cluster_id> --snapshot-retention-limit <number_of_days> --apply-immediately

References

https://docs.aws.amazon.com/securityhub/latest/userguide/emr-controls.html#emr-1
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-vpc-launching-job-flows.html