> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# EMR Cluster Master Node Should Not Have Public IP

### More Info:

Ensure that EMR Cluster Master nodes don't have public Ips

### Risk Level

High

### Addresses

Security

### Compliance Standards

SOC2,ISO27001,HITRUST,NISTCSF,PCIDSS,SEBI,RBI\_MD\_ITF,RBI\_UCB

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of EMR Cluster Master Node having a public IP in AWS, you can follow these steps using the AWS Management Console:

        1. **Access the AWS Management Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)).

        2. **Navigate to EMR Service**: Click on the "Services" dropdown in the top left corner, search for "EMR" (Elastic MapReduce), and click on it to open the EMR dashboard.

        3. **Select the EMR Cluster**: From the list of EMR clusters, select the cluster where the Master Node has a public IP address that needs to be remediated.

        4. **Update Security Configuration**:
           * Click on the "Security and access" tab in the cluster details.
           * Under the "Security groups" section, click on the security group associated with the Master Node.

        5. **Edit Security Group Rules**:
           * In the security group settings, locate the inbound rule that allows inbound traffic to the Master Node from the internet (0.0.0.0/0).
           * Edit the inbound rule to restrict access to the Master Node by changing the source IP range to a specific IP or CIDR block that needs access.

        6. **Remove Public IP**:
           * In the EMR Cluster settings, find the Master Node configuration.
           * Update the network settings to remove the public IP assignment for the Master Node.

        7. **Save Changes**: Once you have made the necessary changes to the security group rules and network settings, save the configuration changes.

        8. **Verify Configuration**:
           * After saving the changes, verify that the Master Node no longer has a public IP address assigned to it.
           * Test the connectivity to ensure that the necessary access is still available without exposing the Master Node to the public internet.

        By following these steps, you can remediate the misconfiguration of an EMR Cluster Master Node having a public IP address in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of having a public IP assigned to the EMR Cluster Master Node in AWS, you can follow these steps using the AWS CLI:

        1. Identify the EMR Cluster Master Node:
           Run the following AWS CLI command to describe the cluster and identify the Master Node's public IP address:
           ```
           aws emr describe-cluster --cluster-id YOUR_CLUSTER_ID --query 'Cluster.MasterPublicDnsName'
           ```

        2. Modify the Security Group associated with the EMR Cluster:
           Run the following AWS CLI command to identify the security group attached to the EMR Cluster:
           ```
           aws emr describe-cluster --cluster-id YOUR_CLUSTER_ID --query 'Cluster.SecurityGroups[0].Name'
           ```

        3. Update the Security Group to remove the inbound rule allowing SSH (port 22) access from 0.0.0.0/0:
           Run the following AWS CLI command to revoke the ingress rule for port 22:
           ```
           aws ec2 revoke-security-group-ingress --group-id YOUR_SECURITY_GROUP_ID --protocol tcp --port 22 --cidr 0.0.0.0/0
           ```

        4. Verify the Public IP has been removed:
           Run the following AWS CLI command to describe the cluster and confirm that the Master Node no longer has a public IP address:
           ```
           aws emr describe-cluster --cluster-id YOUR_CLUSTER_ID --query 'Cluster.MasterPublicDnsName'
           ```

        By following these steps, you can remediate the misconfiguration of having a public IP assigned to the EMR Cluster Master Node in AWS using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of the EMR Cluster Master Node having a public IP in AWS, you can follow these steps using Python and Boto3:

        1. Import the necessary libraries:

        ```python theme={null}
        import boto3
        ```

        2. Initialize the AWS client for EMR:

        ```python theme={null}
        emr_client = boto3.client('emr', region_name='your_region')
        ```

        3. Identify the EMR Cluster ID for the cluster with the Master Node having a public IP:

        ```python theme={null}
        cluster_id = 'your_cluster_id'
        ```

        4. Describe the cluster to get the current configuration:

        ```python theme={null}
        response = emr_client.describe_cluster(ClusterId=cluster_id)
        ```

        5. Check if the Master Public DNS Name is present in the response:

        ```python theme={null}
        if 'MasterPublicDnsName' in response['Cluster']:
            # Disassociate the public IP from the Master Node
            emr_client.modify_instance_fleet(ClusterId=cluster_id, InstanceFleet={ 'InstanceFleetType': 'MASTER', 'TargetOnDemandCapacity': 1 })
            print("Public IP removed from Master Node successfully.")
        else:
            print("Master Node does not have a public IP.")
        ```

        6. Run the Python script to remediate the misconfiguration and remove the public IP from the Master Node of the EMR Cluster.

        By following these steps, you can remediate the misconfiguration of the EMR Cluster Master Node having a public IP in AWS using Python and Boto3.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>