Ensure that your AWS Elastic MapReduce (EMR) clusters are encrypted in order to meet security and compliance requirements. Data encryption helps prevent unauthorized users from reading sensitive data available on your EMR clusters and their associated data storage systems. This includes data saved to persistent media, known as data at-rest, and data that can be intercepted as it travels through the network, known as data in-transit.
This rule can help you with the following compliance standards:
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
When working with production data it is highly recommended to implement encryption in order to protect this data from unauthorized access and fulfill compliance requirements for data-at-rest and in-transit encryption within your organization. For example, a compliance requirement is to protect sensitive data that could potentially identify a specific individual such as Personally Identifiable Information (PII), usually used in Financial Services, Healthcare and Telecommunications sectors.
Note: In-transit and at-rest encryption can be enabled only for clusters with Amazon EMR version 4.8.0 and above.
To determine in-transit and at-rest encryption configuration for your AWS EMR clusters, perform the following:
To enable in-transit and at-rest encryption for your existing AWS EMR clusters, you must define and configure an EMR security configuration then re-create these clusters with the new security configuration. To relaunch the required EMR clusters, perform the following: