Amazon EMR security configurations should have encryption in transit enabled

How to fix it

• Replaces the resource: A security configuration cannot be edited and a cluster keeps the one it launched with, so create a new one, launch new clusters with it, then delete this one.
• Affects another check: The new configuration is read by EMR.3 too, which fails it unless at-rest encryption is also turned on.

In the console

Amazon EMR → Security Configurations → Create security configuration → Encryption

In-transit encryption

Turned on

Certificate provider type

EMR-managed (release 7.11.0 or later), or PEM with a zip of certificates in S3

With the AWS CLI

aws emr create-security-configuration --name <new-security-configuration-name> --security-configuration '{"EncryptionConfiguration":{"EnableInTransitEncryption":true,"InTransitEncryptionConfiguration":{"TLSCertificateConfiguration":{"CertificateProviderType":"EMR"}}}}' --region <region>

With Terraform

resource "aws_emr_security_configuration" "this" {
  name = var.security_configuration_name

  configuration = jsonencode({
    EncryptionConfiguration = {
      EnableInTransitEncryption = true
      InTransitEncryptionConfiguration = {
        TLSCertificateConfiguration = {
          CertificateProviderType = "EMR"
        }
      }
    }
  })
}