AWS prescriptive-guidance medium security documentation change
Summary
Minor grammatical fixes, removed detailed explanation of write-ahead logging and S3 versioning, updated SSH security group instruction to emphasize IP restriction.
Security assessment
The change explicitly modifies security group settings to restrict SSH access to a specific IP address, which is a security hardening measure. This directly addresses potential unauthorized access risks.
Diff
diff --git a/prescriptive-guidance/latest/patterns/multi-az-failover-spark-emr-clusters-arc.md b/prescriptive-guidance/latest/patterns/multi-az-failover-spark-emr-clusters-arc.md index 02010b7d7..90fa0ee65 100644 --- a//prescriptive-guidance/latest/patterns/multi-az-failover-spark-emr-clusters-arc.md +++ b//prescriptive-guidance/latest/patterns/multi-az-failover-spark-emr-clusters-arc.md @@ -15 +15 @@ This pattern offers an efficient disaster recovery strategy for Amazon EMR workl -Under standard conditions, the primary Availability Zone hosts an active EMR cluster and application with full read/write functionality. If an Availability Zone fails unexpectedly, traffic is automatically redirected to the secondary Availability Zone, where a new EMR cluster is launched. Both Availability Zones access a shared Amazon Simple Storage Service (Amazon S3) bucket through dedicated [gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html), which ensures consistent data management. This approach minimizes downtime and enables rapid recovery for critical big data workloads during Availability Zone failures. The solution is useful in industries such as finance or retail, where real-time analytics are crucial. +Under standard conditions, the primary Availability Zone hosts an active EMR cluster and application with full read/write functionality. If an Availability Zone fails unexpectedly, traffic is automatically redirected to the secondary Availability Zone, where a new EMR cluster is launched. Both Availability Zones access a shared Amazon Simple Storage Service (Amazon S3) bucket through dedicated [gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html), which ensure consistent data management. This approach minimizes downtime and enables rapid recovery for critical big data workloads during Availability Zone failures. The solution is useful in industries such as finance or retail, where real-time analytics are crucial. @@ -73,3 +73 @@ This architecture provides application resilience by using multiple Availability - 3. Amazon S3 serves as a central data repository and is potentially used as a checkpoint or as shared storage between EMR clusters. - -EMR clusters maintain data consistency when they write directly to Amazon S3 through the `s3://` protocol and the [EMR File System (EMRFS)](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-fs.html). To ensure data integrity, the solution in this pattern implements [write-ahead logging (WAL)](https://docs.aws.amazon.com/emr/latest/ManagementGuide/using-service-linked-roles-wal.html) to Amazon S3 and uses the Amazon S3 versioning capability to track data versions and enable rollbacks when needed. For read operations, clusters access the shared Amazon S3 storage layer by using [Amazon S3 Select](https://docs.aws.amazon.com/AmazonS3/latest/userguide/selecting-content-from-objects.html) for optimized performance, complemented by the Spark caching mechanism to minimize repeated Amazon S3 access. Amazon S3 is designed for 99.999999999% durability across multiple Availability Zones, provides native Amazon EMR integration, and delivers a highly reliable cross-cluster data consistency solution. + 3. Amazon S3 serves as a central data repository and is potentially used as a checkpoint or as shared storage between EMR clusters. EMR clusters maintain data consistency when they write directly to Amazon S3 through the `s3://` protocol and the [EMR File System (EMRFS)](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-fs.html). @@ -161 +159 @@ Configure security settings for the EMR cluster.| - 2. To enhance security, modify the security group settings to permit Secure Shell (SSH) access (TCP port 22) to the master node, but restrict it to your specific IP address.For more information, see the [Amazon EMR documentation](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-connect-master-node-ssh.html). + 2. To enhance security, modify the security group settings to permit SSH access (TCP port 22) to the master node, but restrict it to your specific IP address.For more information, see the [Amazon EMR documentation](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-connect-master-node-ssh.html). @@ -182 +180 @@ For more information about creating and modifying the Spark application, see the -For example (based on the folders you set up earlier): +Here’s an example based on the folders you set up earlier: