Amazon EMR cluster primary nodes should not have public IP addresses

How to fix it

• Replaces the resource: A node's public address cannot be removed after launch: launch a replacement cluster in a private subnet, move the work to it, then terminate this one, which clears the finding.
• Can break clients: Nodes in a private subnet reach the internet only through a NAT gateway or VPC endpoints, and the web interfaces and SSH lose their public name, so they need a route into the VPC.

In the console

EMR → Clusters → Create cluster → Networking

Virtual private cloud (VPC)

The VPC holding the private subnet below

Subnet

A private subnet with auto-assign public IPv4 off and a route to Amazon S3, such as an S3 gateway endpoint

With Terraform

resource "aws_emr_cluster" "this" {
  name          = var.cluster_name
  release_label = var.release_label
  service_role  = var.service_role_arn

  ec2_attributes {
    subnet_id        = var.private_subnet_id
    instance_profile = var.instance_profile_arn
  }
}