Amazon EMR cluster primary nodes should not have public IP addresses

How to fix it

Set at creation: fixing it means replacing the resource.

Have the named cluster's primary node on a private subnet, with no public address on it. A public address is attached when the instance launches and cannot be taken off afterwards, so the work is to launch a replacement in a subnet whose automatic public addressing is off, move the work over, and terminate this cluster; the finding clears when this cluster is gone, not when the replacement appears. Nodes on a private subnet have no route out of their own, so anything that reached the internet during startup needs a NAT gateway or VPC endpoints.

In the console

EMR → Clusters → Create cluster → Networking

With Terraform

resource "aws_emr_cluster" "this" {
  name          = var.cluster_name
  release_label = var.release_label
  service_role  = var.service_role_arn

  ec2_attributes {
    subnet_id        = var.private_subnet_id
    instance_profile = var.instance_profile_arn
  }
}