Amazon EMR block public access setting should be enabled

How to fix it

• Overwrites existing settings: Each write replaces the whole exception list rather than adding or removing one range, so the Terraform and CLI routes remove every range other than 22.
• Can break clients: Clusters in public subnets whose security groups open another port to 0.0.0.0/0 or ::/0 fail to launch, and such a rule added to a running cluster is revoked where EMR is allowed to.

In the console

EMR → EMR on EC2 → Block public access, in the Region the finding names

Block public access

Turn on

Port range exceptions

Port 22 only, or none. Any other port or range fails this check even with the block on.

With the AWS CLI

aws emr put-block-public-access-configuration --block-public-access-configuration '{"BlockPublicSecurityGroupRules":true,"PermittedPublicSecurityGroupRuleRanges":[{"MinRange":22,"MaxRange":22}]}' --region <region>

With Terraform

resource "aws_emr_block_public_access_configuration" "this" {
  block_public_security_group_rules = true

  permitted_public_security_group_rule_range {
    min_range = 22
    max_range = 22
  }
}