EMR cluster is not configured with SSE KMS for data at rest encryption (Amazon S3 with EMRFS)

Description

Enabling Amazon S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) for your Amazon Elastic MapReduce (EMR) cluster’s security configuration can help to protect the data stored in your cluster.
SSE-KMS uses a customer master key (CMK) in the AWS KMS to encrypt and decrypt data stored in Amazon S3.

Fix - Buildtime

Terraform
  • Resource: aws_emr_security_configuration
  • Argument: EnableAtRestEncryption

go aws_emr_security_configuration.test.tf resource “aws_emr_security_configuration” “test” { … configuration = <<EOF { “EncryptionConfiguration”: { “EnableAtRestEncryption”: true, “AtRestEncryptionConfiguration”: { “S3EncryptionConfiguration”: { + “EncryptionMode”: “SSE-KMS”, + “AwsKmsKey”: “${module.encryption_module.kms_key_alias}” }, “LocalDiskEncryptionConfiguration”: { “EncryptionKeyProviderType”: “AwsKms”, “AwsKmsKey”: “${module.encryption_module.kms_key_alias}” } }, “EnableInTransitEncryption”: true } } EOF }

ReLambda