Back to Checks
aws

EMR account has Block Public Access enabled

emr_cluster_account_public_block_enabled
Service: emrSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

Amazon EMR account-level Block Public Access configuration is assessed per Region. When BlockPublicSecurityGroupRules is enabled, clusters cannot use security groups that allow inbound public sources (0.0.0.0/0, ::/0) except on permitted ports.

Prowler logoProwlerprowler-provider-aws

Risk

Public EMR-facing rules enable Internet reachability to cluster nodes and UIs, inviting brute force and remote exploits.

Attackers can exfiltrate job data, alter processing, or pivot into the VPC, degrading confidentiality, integrity, and availability through data theft, tampering, and service disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks emr_cluster_account_public_block_enabled

Recommendation

Keep EMR Block Public Access enabled and minimize exceptions; allow only required ports and restrict sources.

Apply least privilege on security groups, place clusters in private subnets, and use bastion hosts or Session Manager. Combine with VPC controls and monitoring for defense in depth.

Remediation

CLI

aws emr put-block-public-access-configuration --block-public-access-configuration BlockPublicSecurityGroupRules=true

Terraform

# Enable EMR Block Public Access (account/Region level)
resource "aws_emr_block_public_access_configuration" "example_resource_name" {
  block_public_security_group_rules = true  # CRITICAL: enables Block Public Access
}

NativeIaC

# CloudFormation: Enable EMR Block Public Access (account/Region level)
Resources:
  EmrBpaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EmrBpaPut
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: elasticmapreduce:PutBlockPublicAccessConfiguration
                Resource: "*"

  EmrBpaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt EmrBpaRole.Arn
      Runtime: python3.12
      Handler: index.handler
      Code:
        ZipFile: |
          import boto3, json, urllib.request
          def handler(event, context):
              try:
                  boto3.client('emr').put_block_public_access_configuration(
                      BlockPublicAccessConfiguration={
                          'BlockPublicSecurityGroupRules': True  # CRITICAL: enables EMR Block Public Access
                      }
                  )
                  status='SUCCESS'
              except Exception:
                  status='FAILED'
              body=json.dumps({
                  'Status': status,
                  'PhysicalResourceId': 'EmrBPA',  # respond to CFN
                  'StackId': event['StackId'],
                  'RequestId': event['RequestId'],
                  'LogicalResourceId': event['LogicalResourceId']
              }).encode()
              req=urllib.request.Request(event['ResponseURL'], data=body, method='PUT')
              req.add_header('content-type','')
              req.add_header('content-length',str(len(body)))
              urllib.request.urlopen(req)

  EmrBpa:
    Type: Custom::EmrBpa
    Properties:
      ServiceToken: !GetAtt EmrBpaFunction.Arn  # Invokes Lambda to apply the setting

Other

1In the AWS Console, go to Amazon EMR
2Select the target Region (top-right)
3In the left menu under "EMR on EC2", click "Block public access"
4Click "Edit" and choose "Turn on"
5Click "Save"

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.emr.emr_client import emr_client


class emr_cluster_account_public_block_enabled(Check):
    def execute(self):
        findings = []
        for region in emr_client.block_public_access_configuration:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=emr_client.block_public_access_configuration,
            )
            report.region = region
            report.resource_id = emr_client.audited_account
            report.resource_arn = emr_client._get_cluster_arn_template(region)
            if emr_client.block_public_access_configuration[
                region
            ].block_public_security_group_rules:
                report.status = "PASS"
                report.status_extended = "EMR Account has Block Public Access enabled."
            else:
                report.status = "FAIL"
                report.status_extended = "EMR Account has Block Public Access disabled."

            findings.append(report)

        return findings

References