Amazon EMR security configurations should have encryption at rest enabled

How to fix it

• Replaces the resource: A security configuration cannot be edited and a cluster keeps the one it launched with, so create a new one, launch new clusters with it, then delete this one.
• Can break clients: The cluster's EC2 instance profile (EMR_EC2_DefaultRole by default) must be allowed to use the KMS key, so add it as a key user first.
• Affects another check: The new configuration is read by EMR.4 too, which fails it unless in-transit encryption is also turned on.

In the console

Amazon EMR → Security Configurations → Create security configuration → Encryption

At rest encryption

Turned on, for S3 data, local disks or both

Encryption mode

Under S3 data encryption: SSE-S3, or SSE-KMS with an AWS KMS key

Key provider type

Under Local disk encryption: AWS KMS key, with a key in the cluster's Region

With the AWS CLI

aws emr create-security-configuration --name <new-security-configuration-name> --security-configuration '{"EncryptionConfiguration":{"EnableAtRestEncryption":true,"AtRestEncryptionConfiguration":{"S3EncryptionConfiguration":{"EncryptionMode":"SSE-S3"},"LocalDiskEncryptionConfiguration":{"EncryptionKeyProviderType":"AwsKms","AwsKmsKey":"<kms-key-arn>"}}}}' --region <region>

With Terraform

resource "aws_emr_security_configuration" "this" {
  name = var.security_configuration_name

  configuration = jsonencode({
    EncryptionConfiguration = {
      EnableAtRestEncryption = true
      AtRestEncryptionConfiguration = {
        S3EncryptionConfiguration = {
          EncryptionMode = "SSE-S3"
        }
        LocalDiskEncryptionConfiguration = {
          EncryptionKeyProviderType = "AwsKms"
          AwsKmsKey                 = var.kms_key_arn
        }
      }
    }
  })
}