EMR account has Block Public Access enabled
emr_cluster_account_public_block_enabled
Amazon EMR account-level Block Public Access configuration is assessed per Region. When BlockPublicSecurityGroupRules is enabled, clusters cannot use security groups that allow inbound public sources (0.0.0.0/0, ::/0) except on permitted ports.
Risk
Public EMR-facing rules enable Internet reachability to cluster nodes and UIs, inviting brute force and remote exploits.
Attackers can exfiltrate job data, alter processing, or pivot into the VPC, degrading confidentiality, integrity, and availability through data theft, tampering, and service disruption.
prowler aws --checks emr_cluster_account_public_block_enabled
Recommendation
Keep EMR Block Public Access enabled and minimize exceptions; allow only required ports and restrict sources.
Apply least privilege on security groups, place clusters in private subnets, and use bastion hosts or Session Manager. Combine with VPC controls and monitoring for defense in depth.
Remediation
aws emr put-block-public-access-configuration --block-public-access-configuration BlockPublicSecurityGroupRules=true
- In the AWS Console, go to Amazon EMR
- Select the target Region (top-right)
- In the left menu under "EMR on EC2", click "Block public access"
- Click "Edit" and choose "Turn on"
- Click "Save"
Source Code
Resource Type
Other