Skip to main content

🛡️ AWS EMR Cluster encryption is disabled🟢⚪

Stats​

not available

Similar Policies​

Description​

Open File

Description​

This policy identifies Amazon EMR clusters that are not associated with an EMR security configuration. Security configurations enable encryption and other protective controls to safeguard sensitive data processed and stored by EMR clusters.

Data encryption helps prevent unauthorized access to sensitive information within EMR clusters and their associated storage systems. This includes data stored on persistent media (data at rest) and data transmitted across the network (data in transit).

Rationale​

Protecting data throughout its lifecycle is a fundamental security requirement for distributed data processing environments such as Amazon EMR.

  1. Encryption at Rest

    Prevents unauthorized access to data stored on local disks or attached Amazon EBS volumes in the event of underlying infrastructure compromise.

  2. Encryption in Transit

    Protects data exchanged between EMR nodes (for example, primary and core nodes in the Hadoop ecosystem), reducing the risk of man-in-the-middle attacks within the VPC.

... see more

Remediation​

Open File

Remediation​

Associate an EMR Cluster with a Security Configuration​

Amazon EMR security configurations define encryption settings for data at rest and data in transit, as well as other security controls such as Kerberos authentication. Ensure that all new clusters are launched with a security configuration applied.

Note: Security configurations cannot be applied to an existing cluster after it is launched. This remediation applies only to new clusters.

From Command Line​

  1. Create or identify an existing security configuration:

    aws emr list-security-configurations
    aws emr create-security-configuration --name "{{security-config-name}}" --security-configuration '{
        "EncryptionConfiguration": {
            "EnableInTransitEncryption": true,
            "EnableAtRestEncryption": true,
            "InTransitEncryptionConfiguration": {
                "TLSCertificateConfiguration": {
                    "CertificateProviderType": "PEM",
                    "S3Object": "arn:aws:s3:::{{MyConfigStore}}/{{artifacts}}/{{MyCerts}}.zip"

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.3] Amazon EMR security configurations should be encrypted at rest1no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.4] Amazon EMR security configurations should be encrypted in transit1no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest20no data
💼 AWS Well-Architected → 💼 SEC09-BP02 Enforce encryption in transit1no data
💼 Cloudaware Framework → 💼 Data Encryption65no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)248188no data
💼 FedRAMP High Security Controls → 💼 CP-9(8) Cryptographic Protection (M)(H)2no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1926no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)925no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1844no data
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)822no data
💼 FedRAMP High Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)8no data
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)126no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)25no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)44no data
💼 FedRAMP Low Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)1169no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9(8) Cryptographic Protection (M)(H)2no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)126no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)25no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)44no data
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)8no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained128no data
💼 NIST CSF v2.0 → 💼 ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained8no data
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles28no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected219no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage165no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement32120207no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9(8) System Backup _ Cryptographic Protection2no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services49no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8 Transmission Confidentiality and Integrity5926no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection924no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(2) Transmission Confidentiality and Integrity _ Pre- and Post-transmission Handling16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection432no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23 Session Authenticity515no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23(3) Session Authenticity _ Unique System-generated Session Identifiers14no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-12 Information Management and Retention38no data