Skip to main content

🛡️ AWS EMR Cluster encryption is disabled🟢⚪

Similar Policies​

Description​

Open File

Description​

This policy identifies Amazon EMR clusters that are not associated with an EMR security configuration. Security configurations enable encryption and other protective controls to safeguard sensitive data processed and stored by EMR clusters.

Data encryption helps prevent unauthorized access to sensitive information within EMR clusters and their associated storage systems. This includes data stored on persistent media (data at rest) and data transmitted across the network (data in transit).

Rationale​

Protecting data throughout its lifecycle is a fundamental security requirement for distributed data processing environments such as Amazon EMR.

  1. Encryption at Rest

    Prevents unauthorized access to data stored on local disks or attached Amazon EBS volumes in the event of underlying infrastructure compromise.

  2. Encryption in Transit

    Protects data exchanged between EMR nodes (for example, primary and core nodes in the Hadoop ecosystem), reducing the risk of man-in-the-middle attacks within the VPC.

... see more

Remediation​

Open File

Remediation​

Associate an EMR Cluster with a Security Configuration​

Amazon EMR security configurations define encryption settings for data at rest and data in transit, as well as other security controls such as Kerberos authentication. Ensure that all new clusters are launched with a security configuration applied.

Note: Security configurations cannot be applied to an existing cluster after it is launched. This remediation applies only to new clusters.

From Command Line​

  1. Create or identify an existing security configuration:

    aws emr list-security-configurations
    aws emr create-security-configuration --name "{{security-config}}" --security-configuration '{
        "EncryptionConfiguration": {
            "EnableInTransitEncryption": true,
            "EnableAtRestEncryption": true,
            "InTransitEncryptionConfiguration": {
                "TLSCertificateConfiguration": {
                    "CertificateProviderType": "PEM",
                    "S3Object": "arn:aws:s3:::{{MyConfigStore}}/{{artifacts}}/{{MyCerts}}.zip"

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.3] Amazon EMR security configurations should be encrypted at rest1no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.4] Amazon EMR security configurations should be encrypted in transit1no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest19no data
💼 AWS Well-Architected → 💼 SEC09-BP02 Enforce encryption in transit1no data
💼 Cloudaware Framework → 💼 Data Encryption66no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23795no data
💼 FedRAMP High Security Controls → 💼 CP-9(8) Cryptographic Protection (M)(H)2no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)41no data
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1823no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)822no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1640no data
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)719no data
💼 FedRAMP High Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)6no data
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)123no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)22no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Low Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)6no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)179no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9(8) Cryptographic Protection (M)(H)2no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)41no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)123no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)19no data
💼 FedRAMP Moderate Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)6no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events162no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained81no data
💼 NIST CSF v2.0 → 💼 ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained6no data
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles26no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected173no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected149no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected169no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage112no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269110no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks39no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9(8) System Backup _ Cryptographic Protection2no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services41no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8 Transmission Confidentiality and Integrity5823no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection821no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(2) Transmission Confidentiality and Integrity _ Pre- and Post-transmission Handling14no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection429no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23 Session Authenticity513no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23(3) Session Authenticity _ Unique System-generated Session Identifiers12no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-12 Information Management and Retention36no data