Amazon EMR block public access setting should be enabled

How to fix it

Turn EMR block public access on in the Region the finding names, permitting no public port other than 22. A permitted range is a port EMR will still let a cluster open to every address, so one left over from an old debugging session keeps the finding even with the block on. There is no operation that adds or removes a single exception, so setting this replaces the exception list entirely. The block acts on running clusters as well as new ones, so automation that launches clusters opening other ports in public subnets starts failing.

In the console

EMR → EMR on EC2 → Block public access, in the Region the finding names

With the AWS CLI

aws emr put-block-public-access-configuration --block-public-access-configuration '{"BlockPublicSecurityGroupRules":true,"PermittedPublicSecurityGroupRuleRanges":[{"MinRange":22,"MaxRange":22}]}' --region <region>

With Terraform

resource "aws_emr_block_public_access_configuration" "this" {
  block_public_security_group_rules = true

  permitted_public_security_group_rule_range {
    min_range = 22
    max_range = 22
  }
}