AWS emr: EMR 7.14.0 release notes: Kerberos, encryption, Secret Agent fixes
Summary
Updates the EMR 'What's New' page from 7.13.0 to 7.14.0, replacing the previous release's feature list, application upgrades, and known issues with new entries. Security-relevant additions include improved Kerberos authentication reliability (newer secure ciphers, no KerberosSecretDecryptorException, more reliable ticket refresh), more tolerant local disk encryption verification during cluster startup, improved Secret Agent startup reliability, and HBase read replicas protected from unauthorized writes. Also adds Ion DataSource FTA support, Trino-without-HDFS, and various version bumps.
Security assessment
The diff is a routine release-notes refresh, but it documents security-relevant fixes: Kerberos authentication reliability with newer secure ciphers and reliable ticket refresh, plus disk-encryption verification tolerance and Secret Agent startup fixes. These are hardening/operational reliability improvements rather than a disclosed vulnerability or CVE, so no concrete security incident is evidenced.
Evidence
+ * **Improved Kerberos authentication reliability** — Kerberos-secured clusters now start Spark jobs with newer secure ciphers without `KerberosSecretDecryptorException` errors. Kerberos ticket refresh is also more reliable.
Diff
diff --git a/emr/latest/ReleaseGuide/emr-whatsnew.md b/emr/latest/ReleaseGuide/emr-whatsnew.md index 558894c25..7915c53b6 100644 --- a//emr/latest/ReleaseGuide/emr-whatsnew.md +++ b//emr/latest/ReleaseGuide/emr-whatsnew.md @@ -7 +7 @@ -Spark AgentsAmazon EMR 7.13.0Amazon EMR 6.15.0Amazon EMR 5.36.2SigV4 compatibility +Spark AgentsAmazon EMR 7.14.0Amazon EMR 6.15.0Amazon EMR 5.36.2SigV4 compatibility @@ -13 +13 @@ This page describes the changes and functionality available in the latest releas -These release notes are also available on the [Amazon EMR 7.13.0](./emr-7130-release.html), [Amazon EMR 6.15.0](./emr-6150-release.html), and [Amazon EMR 5.36.2](./emr-5362-release.html) pages, along with the application versions, component versions, and available configuration classifications for each release. +These release notes are also available on the [Amazon EMR 7.14.0](./emr-7140-release.html), [Amazon EMR 6.15.0](./emr-6150-release.html), and [Amazon EMR 5.36.2](./emr-5362-release.html) pages, along with the application versions, component versions, and available configuration classifications for each release. @@ -40 +40 @@ You can use the agent to troubleshoot PySpark and Scala applications failures. T -## Amazon EMR 7.13.0 (latest release of 7.x series) +## Amazon EMR 7.14.0 (latest release of 7.x series) @@ -44 +44 @@ New Amazon EMR releases are made available in different Regions over a period of -The following release notes include information for Amazon EMR release 7.13.0. +The following release notes include information for Amazon EMR release 7.14.0. @@ -48 +48 @@ The following release notes include information for Amazon EMR release 7.13.0. - * **Python 3.11 default for PySpark and Spark workloads** — Python 3.11 is now the default Python version for PySpark and Spark workloads. Python 3.9 remains the default for all other applications. Both Python 3.9 and 3.11 are included in the release. + * **Incremental refresh improvements for Iceberg materialized views** — Incremental refresh now supports Merge-on-Read tables through change data capture. This enables fast refreshes for workloads that use updates and deletes. Refresh reads only the data files affected by a change, using per-file and manifest-level column statistics. @@ -49,0 +50 @@ The following release notes include information for Amazon EMR release 7.13.0. + * **AWS Glue Table VersionId propagated to Hive table parameters** — When you use AWS Glue as the Hive metastore, the AWS Glue Table VersionId is now propagated to Hive table parameters. This enables you to track which version of a AWS Glue table definition is in use. @@ -51,5 +52 @@ The following release notes include information for Amazon EMR release 7.13.0. - - -### Changes, enhancements, and resolved issues - - * **Iceberg configuration property** — Amazon EMR 7.13 adds a new Iceberg configuration property, `spark.sql.catalog.spark_catalog.route-non-iceberg-drop-to-session-catalog`. When set to `true`, `DROP TABLE` on non-Iceberg managed tables in `SparkSessionCatalog` deletes both the table metadata and the underlying Amazon S3 data. The default value is `false`. + * **Ion DataSource tables with fine-grained access control** — You can now create Ion DataSource tables when you use Amazon EMR clusters with Fine-grained Table Access (FTA) mode enabled. @@ -60,5 +57 @@ The following release notes include information for Amazon EMR release 7.13.0. -### Application upgrades - -The following applications are upgraded in this release: - - * HBase 2.6.4-amzn-0 (upgraded from 2.6.2-amzn-3) +### Changes, enhancements, and resolved issues @@ -66 +59 @@ The following applications are upgraded in this release: - * Hadoop 3.4.2-amzn-0 (upgraded from 3.4.1-amzn-4) + * **Improved disk encryption verification tolerance during cluster startup** — Clusters with local disk encryption enabled in their security configuration are now more tolerant of transient network connectivity delays during instance boot. This change reduces intermittent cluster startup failures. @@ -68 +61 @@ The following applications are upgraded in this release: - * Phoenix 5.3.0 (upgraded from 5.2.1) + * **Fixed UTF-8 multibyte character handling in Amazon EMR configurations** — Amazon EMR configurations now correctly support UTF-8 multibyte characters. This includes values with accented letters or non-Latin scripts. For more information, see [Configure applications](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html). @@ -70 +63 @@ The following applications are upgraded in this release: - * Hudi 1.0.2-amzn-2 (upgraded from 1.0.2-amzn-1) + * **Improved Kerberos authentication reliability** — Kerberos-secured clusters now start Spark jobs with newer secure ciphers without `KerberosSecretDecryptorException` errors. Kerberos ticket refresh is also more reliable. @@ -72 +65 @@ The following applications are upgraded in this release: - * Trino 479-amzn-1 (upgraded from 476-amzn-1) + * **Improved HBase reliability** — Read-only to read-write promotion now completes in approximately 10 to 15 seconds instead of 6 minutes. Read replicas are protected from HFile cleanup data corruption and unauthorized writes, while deactivation races are resolved. Store file metadata caching reduces Amazon S3 API calls. Snapshot restores using the FILE-based `StoreFileTracker` now succeed, and snapshot deletion no longer stops HFile cleaning. Region server archiving no longer retries indefinitely after a file was moved or deleted. @@ -74 +67 @@ The following applications are upgraded in this release: - * AWS SDK v2 2.42.12 (upgraded from 2.35.5) + * **Amazon EMR now supports launching Trino clusters without Hadoop and HDFS** — When you select Trino as the only application at launch, Amazon EMR no longer starts YARN and HDFS. To add Hadoop and HDFS to a Trino cluster, these applications will need to be explicitly added to the list of applications at cluster launch. @@ -76 +69 @@ The following applications are upgraded in this release: - * AWS SDK v1 1.12.797 (upgraded from 1.12.792) + * **Improved Secret Agent startup reliability** — Fixes two issues that could cause Amazon EMR cluster provisioning failures related to the Secret Agent security service. Certificate creation now waits for HDFS readiness before proceeding, and the startup script retries detection of the Secret Agent Java process. Together these changes reduce launch failures on clusters with slower storage initialization or heavily loaded instances. @@ -78 +70,0 @@ The following applications are upgraded in this release: - * Spark 3.5.6-amzn-2, Hive 3.1.3-amzn-22, Tez 0.10.2-amzn-20, Presto 0.287-amzn-7, Iceberg 1.10.0-amzn-1, Delta 3.3.2-amzn-2, Flink 1.20.0-amzn-7, ZooKeeper 3.9.3-amzn-5 (amzn patch bumps) @@ -81,0 +74 @@ The following applications are upgraded in this release: +### Application upgrades @@ -83 +76 @@ The following applications are upgraded in this release: -### Known issues and limitations +The following applications are upgraded in this release: @@ -85 +78 @@ The following applications are upgraded in this release: - * Configuring `yarn.nodemanager.log-dirs` with a value of length longer than 512 characters will cause S3 log upload to fail. + * Spark Redshift connector @@ -86,0 +80 @@ The following applications are upgraded in this release: + * NVIDIA Spark RAPIDS plugin 26.04.1-amzn-0 (upgraded from 25.08.0-amzn-0) @@ -87,0 +82 @@ The following applications are upgraded in this release: + * AWS SDK v2 2.44.5 (upgraded from 2.42.12) @@ -88,0 +84 @@ The following applications are upgraded in this release: + * Amazon Redshift JDBC driver @@ -90 +85,0 @@ The following applications are upgraded in this release: - * The following table lists the Amazon Linux release labels, kernel versions, available dates, and supported AWS Regions. @@ -92,6 +86,0 @@ The following applications are upgraded in this release: -OsReleaseLabel (Amazon Linux version) | Amazon Linux kernel version | Available date | Supported Regions ----|---|---|--- -2023.12.20260803.3 | 6.1.177-224.371.amzn2023 | August 28, 2026 | US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Taipei), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Osaka), Asia Pacific (Mumbai), Asia Pacific (Hyderabad), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Jakarta), Asia Pacific (Melbourne), Asia Pacific (Malaysia), Asia Pacific (Thailand), Canada (Central), Canada West (Calgary), Europe (Frankfurt), Europe (Zurich), Europe (Stockholm), Europe (Milan), Europe (Spain), Europe (Ireland), Europe (London), Europe (Paris), Israel (Tel Aviv), Mexico (Central), South America (São Paulo), China (Beijing), China (Ningxia), AWS GovCloud (US-East), AWS GovCloud (US-West) -2023.12.20260727.0 | 6.1.176-223.369.amzn2023 | August 13, 2026 | US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Taipei), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Osaka), Asia Pacific (Mumbai), Asia Pacific (Hyderabad), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Jakarta), Asia Pacific (Melbourne), Asia Pacific (Malaysia), Asia Pacific (Thailand), Canada (Central), Canada West (Calgary), Europe (Frankfurt), Europe (Zurich), Europe (Stockholm), Europe (Milan), Europe (Spain), Europe (Ireland), Europe (London), Europe (Paris), Israel (Tel Aviv), Mexico (Central), South America (São Paulo), China (Beijing), China (Ningxia), AWS GovCloud (US-East), AWS GovCloud (US-West) -2023.12.20260629.0 | 6.1.175-219.359.amzn2023 | July 22, 2026 | US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Taipei), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Osaka), Asia Pacific (Mumbai), Asia Pacific (Hyderabad), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Jakarta), Asia Pacific (Melbourne), Asia Pacific (Malaysia), Asia Pacific (Thailand), Canada (Central), Canada West (Calgary), Europe (Frankfurt), Europe (Zurich), Europe (Stockholm), Europe (Milan), Europe (Spain), Europe (Ireland), Europe (London), Europe (Paris), Israel (Tel Aviv), Mexico (Central), South America (São Paulo), China (Beijing), China (Ningxia), AWS GovCloud (US-East), AWS GovCloud (US-West) -2023.12.20260611.0 | 6.1.174-217.345.amzn2023 | July 3, 2026 | US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Taipei), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Osaka), Asia Pacific (Mumbai), Asia Pacific (Hyderabad), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Jakarta), Asia Pacific (Melbourne), Asia Pacific (Malaysia), Asia Pacific (Thailand), Canada (Central), Canada West (Calgary), Europe (Frankfurt), Europe (Zurich), Europe (Stockholm), Europe (Milan), Europe (Spain), Europe (Ireland), Europe (London), Europe (Paris), Israel (Tel Aviv), Mexico (Central), South America (São Paulo), China (Beijing), China (Ningxia), AWS GovCloud (US-East), AWS GovCloud (US-West) @@ -99,0 +89 @@ OsReleaseLabel (Amazon Linux version) | Amazon Linux kernel version | Available +### Known issues and limitations @@ -100,0 +91 @@ OsReleaseLabel (Amazon Linux version) | Amazon Linux kernel version | Available +There are no known issues in this release.