Skip to main content

Amazon EMR Clusters Should Have Kerberos Enabled

More Info:​

This rule checks if Amazon EMR clusters have Kerberos enabled. It is marked as NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not satisfy the specified rule parameters.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of not having Kerberos enabled for Amazon EMR clusters in AWS Redshift using the AWS console, follow these steps:

  1. Login to AWS Console: Go to the AWS Management Console and login with your credentials.

  2. Navigate to Amazon Redshift Console: Click on the "Services" dropdown menu at the top left corner, then select "Redshift" under the Analytics section.

  3. Select your Redshift Cluster: From the list of clusters, select the Redshift cluster for which you want to enable Kerberos.

  4. Modify Cluster: Click on the cluster identifier to open the cluster details. In the cluster details page, click on the "Modify" button.

  5. Enable Kerberos Authentication: Scroll down to the "Security and Access Control" section in the Modify Cluster page.

  6. Enable Kerberos: Under the "Authentication" section, select "Kerberos" as the authentication type. You will need to provide the Kerberos server details such as KDC server hostname, realm, and other relevant information.

  7. Save Changes: After providing the necessary Kerberos authentication details, scroll down to the bottom of the page and click on the "Modify Cluster" button to save the changes.

  8. Verify Kerberos Configuration: Once the modification is completed, verify that Kerberos authentication is successfully enabled for the Redshift cluster.

By following these steps, you can remediate the misconfiguration of not having Kerberos enabled for Amazon EMR clusters in AWS Redshift using the AWS console.

Using CLI

To remediate the misconfiguration of enabling Kerberos on Amazon EMR Clusters in AWS Redshift using AWS CLI, follow these steps:

  1. Enable Kerberos on Redshift Cluster:

    Run the following AWS CLI command to enable Kerberos authentication on the Redshift cluster:

    aws redshift modify-cluster --cluster-identifier <cluster-identifier> --enable-iam-database-authentication

    Replace <cluster-identifier> with the identifier of your Redshift cluster.

  2. Verify Kerberos Authentication:

    To verify that Kerberos authentication has been enabled successfully on the Redshift cluster, describe the cluster using the following command:

    aws redshift describe-clusters --cluster-identifier <cluster-identifier> --query "Clusters[0].IamRoles"

    Ensure that the output includes the IAM roles associated with the Redshift cluster.

  3. Update Security Groups:

    Update the security groups associated with the Redshift cluster to allow the necessary traffic for Kerberos authentication. Ensure that the necessary ports are open for Kerberos communication.

  4. Test Kerberos Authentication:

    Test the Kerberos authentication by connecting to the Redshift cluster using a client that supports Kerberos authentication. Verify that you can successfully authenticate using Kerberos credentials.

By following these steps, you can remediate the misconfiguration of enabling Kerberos on Amazon EMR Clusters in AWS Redshift using AWS CLI.

Using Python

To remediate the misconfiguration of enabling Kerberos for AWS Redshift clusters using Python, you can follow these steps:

  1. Install the required Python packages:
pip install boto3
  1. Use the following Python script to enable Kerberos for AWS Redshift clusters:
import boto3

# Initialize the Redshift client
client = boto3.client('redshift')

# Specify the Redshift cluster identifier
cluster_identifier = 'your-redshift-cluster-identifier'

# Enable Kerberos for the specified Redshift cluster
response = client.modify_cluster(
    ClusterIdentifier=cluster_identifier,
    EnhancedVpcRouting=True,
    IamRoles=[
        'arn:aws:iam::123456789012:role/RedshiftKerberosRole'  # Specify the IAM role for Kerberos
    ],
    ClusterParameterGroupName='default.redshift-1.0',
    NodeType='dc2.large',  # Specify the node type
    NumberOfNodes=2  # Specify the number of nodes
)

print(response)

  1. Replace 'your-redshift-cluster-identifier' with the actual identifier of your Redshift cluster.

  2. Replace 'arn:aws:iam::123456789012:role/RedshiftKerberosRole' with the ARN of the IAM role that should be used for Kerberos authentication.

  3. Run the Python script to enable Kerberos for the specified AWS Redshift cluster.

Please note that you need to have the necessary permissions to modify Redshift clusters in your AWS account.

Using Terraform
resource "aws_emr_security_configuration" "KERBEROS_ENABLED_CONFIG" {
  name = "KERBEROS_ENABLED_CONFIG" # replace with desired security configuration name

  configuration = jsonencode({
    "AuthenticationConfiguration" : {
      "KerberosConfiguration" : {
        "Provider"                            : "ClusterDedicatedKdc",
        "ClusterDedicatedKdcConfiguration"    : {
          "TicketLifetimeInHours" : 24
        },
        "CrossRealmTrustConfiguration"        : {
          "Realm"          : "TRUSTED.REALM.COM",           # replace with trusted realm, or remove block if not needed
          "Domain"         : "trusted.realm.com",           # replace with trusted domain
          "KdcAdminServer" : "kdcadmin.trusted.realm.com"   # replace with KDC admin server
        },
        "Realm"                              : "EXAMPLE.COM",             # replace with Kerberos realm
        "KdcAdminPassword"                   : "KERBEROS_ADMIN_PASSWORD", # replace with secure value from SSM/Secrets Manager
        "KdcServer"                          : "kdc.example.com"          # replace with KDC server hostname
      }
    }
  })
}

resource "aws_emr_cluster" "EMR_CLUSTER" {
  name          = "EMR_CLUSTER_NAME"          # replace with your EMR cluster name
  release_label = "emr-6.15.0"                # replace with required EMR release
  applications  = ["Hadoop"]                  # adjust as needed
  service_role  = "EMR_DefaultRole"           # replace with your EMR service role
  role          = "EMR_EC2_DefaultRole"       # replace with your EMR EC2 instance profile role
  log_uri       = "s3://EMR_LOG_BUCKET/path"  # replace with your S3 log bucket

  master_instance_group {
    instance_type  = "m5.xlarge"              # replace as needed
    instance_count = 1
  }

  core_instance_group {
    instance_type  = "m5.xlarge"              # replace as needed
    instance_count = 2
  }

  # This attachment is what makes the cluster compliant with EMR_KERBEROS_ENABLED
  security_configuration = aws_emr_security_configuration.KERBEROS_ENABLED_CONFIG.name

  # ...any other required arguments...
}

Enabling a different security_configuration on an existing EMR cluster is not supported; this change forces replacement of the aws_emr_cluster.EMR_CLUSTER resource (the old cluster will be terminated and a new one created). This AWS Config rule and remediation do not apply to Amazon Redshift; Redshift has its own authentication and encryption controls.

Verification with terraform plan should show:

  • a new aws_emr_security_configuration.KERBEROS_ENABLED_CONFIG resource to be created, and
  • aws_emr_cluster.EMR_CLUSTER either created with security_configuration set, or replaced so that its security_configuration attribute now references the Kerberos-enabled configuration.

Additional Reading:​