AWS emr documentation change
Summary
Updated VPC configuration requirements for private subnets, including VPC endpoints and security group changes
Security assessment
Adds documentation about network security features (VPC endpoints, security groups) but doesn't address any specific vulnerability. The changes improve guidance for secure network architecture without evidence of security incident remediation.
Diff
diff --git a/emr/latest/ManagementGuide/emr-clusters-in-a-vpc.md b/emr/latest/ManagementGuide/emr-clusters-in-a-vpc.md index 596af248f..b7611b198 100644 --- a//emr/latest/ManagementGuide/emr-clusters-in-a-vpc.md +++ b//emr/latest/ManagementGuide/emr-clusters-in-a-vpc.md @@ -41 +41 @@ Private subnets differ from public subnets in the following ways: - * To access AWS services that do not provide a VPC endpoint, you still must use a NAT instance or an internet gateway. + * For Amazon EMR 8.0.0 and later and Amazon EMR Spark 8.0.0 and later, Amazon EMR provisions a VPC endpoint in your VPC to enable the Amazon EMR cluster to communicate with the Amazon EMR service. You must either provide `ec2:CreateVpcEndpoint` and `ec2:ModifyVpcEndpoint` permissions on your service role for Amazon EMR or create this VPC endpoint manually before launching a cluster. The name of the VPC endpoint service is `aws.api.`region`.emr-service-cell01`. For an example scoped-down policy with tags, see [Service role for Amazon EMR (EMR role)](./emr-iam-role.html). @@ -43 +43 @@ Private subnets differ from public subnets in the following ways: - * At a minimum, you must provide a route to the Amazon EMR service logs bucket and Amazon Linux repository in Amazon S3. For more information, see [Sample policies for private subnets that access Amazon S3](./private-subnet-iampolicy.html) + * To access AWS services that do not provide a VPC endpoint, you still must use a NAT instance or an internet gateway. To configure NAT gateways, see [NAT Gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) in the _Amazon VPC User Guide_. @@ -45,3 +45 @@ Private subnets differ from public subnets in the following ways: - * If you use EMRFS features, you need to have an Amazon S3 VPC endpoint and a route from your private subnet to DynamoDB. - - * Debugging only works if you provide a route from your private subnet to a public Amazon SQS endpoint. + * At a minimum, you must provide a route to Amazon S3 for the buckets required by Amazon EMR. For more information, see [Sample policies for private subnets that access Amazon S3](./private-subnet-iampolicy.html) @@ -49 +47 @@ Private subnets differ from public subnets in the following ways: - * Creating a private subnet configuration with a NAT instance or gateway in a public subnet is only supported using the AWS Management Console. The easiest way to add and configure NAT instances and Amazon S3 VPC endpoints for Amazon EMR clusters is to use the **VPC Subnets List** page in the Amazon EMR console. To configure NAT gateways, see [NAT Gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) in the _Amazon VPC User Guide_. + * If you use EMRFS features, you need to have an Amazon S3 VPC endpoint and a route from your private subnet to DynamoDB. @@ -56 +54 @@ Private subnets differ from public subnets in the following ways: -Amazon EMR creates and uses different default security groups for the clusters in a private subnet: ElasticMapReduce-Master-Private, ElasticMapReduce-Slave-Private, and ElasticMapReduce-ServiceAccess. For more information, see [Control network traffic with security groups for your Amazon EMR cluster](./emr-security-groups.html). +Amazon EMR creates and uses different default security groups for the clusters in a private subnet: ElasticMapReduce-Primary-Private, ElasticMapReduce-Core-Private, and ElasticMapReduce-ServiceAccess. For more information, see [Control network traffic with security groups for your Amazon EMR cluster](./emr-security-groups.html). @@ -62 +60 @@ The following image shows how an Amazon EMR cluster is configured within a priva - + @@ -66 +64 @@ The following image shows a sample configuration for an Amazon EMR cluster withi - +