SecurityConfiguration

Source: src/AWS/EMR/SecurityConfiguration.ts

An Amazon EMR security configuration — a reusable JSON document of encryption, authentication, and instance-metadata settings referenced by name when launching a Cluster.

Clusters capture the configuration at launch, so editing a configuration only affects clusters launched afterwards.

Creating a Security Configuration

Require IMDSv2 on Cluster Instances

const config = yield* SecurityConfiguration("Imds", {
  securityConfiguration: {
    InstanceMetadataServiceConfiguration: {
      MinimumInstanceMetadataServiceVersion: 2,
      HttpPutResponseHopLimit: 1,
    },
  },
});

Encryption Settings

const config = yield* SecurityConfiguration("Encryption", {
  securityConfiguration: {
    EncryptionConfiguration: {
      EnableInTransitEncryption: false,
      EnableAtRestEncryption: true,
      AtRestEncryptionConfiguration: {
        S3EncryptionConfiguration: { EncryptionMode: "SSE-S3" },
      },
    },
  },
});

Using with a Cluster

const cluster = yield* Cluster("Secure", {
  releaseLabel: "emr-7.5.0",
  serviceRole: serviceRole.roleName,
  jobFlowRole: instanceProfile.instanceProfileName,
  securityConfiguration: config.securityConfigurationName,
});