1. Access the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/).
2. Navigate to EMR Service: Click on the “Services” dropdown in the top left corner, search for “EMR” (Elastic MapReduce), and click on it to open the EMR dashboard.
3. Select the EMR Cluster: From the list of EMR clusters, select the cluster where the Master Node has a public IP address that needs to be remediated.
4. Update Security Configuration:
   • Click on the “Security and access” tab in the cluster details.
   • Under the “Security groups” section, click on the security group associated with the Master Node.
5. Edit Security Group Rules:
   • In the security group settings, locate the inbound rule that allows inbound traffic to the Master Node from the internet (0.0.0.0/0).
   • Edit the inbound rule to restrict access to the Master Node by changing the source IP range to a specific IP or CIDR block that needs access.
6. Remove Public IP:
   • In the EMR Cluster settings, find the Master Node configuration.
   • Update the network settings to remove the public IP assignment for the Master Node.
7. Save Changes: Once you have made the necessary changes to the security group rules and network settings, save the configuration changes.
8. Verify Configuration:
   • After saving the changes, verify that the Master Node no longer has a public IP address assigned to it.
   • Test the connectivity to ensure that the necessary access is still available without exposing the Master Node to the public internet.

​

1. Identify the EMR Cluster Master Node: Run the following AWS CLI command to describe the cluster and identify the Master Node’s public IP address:
   aws emr describe-cluster --cluster-id YOUR_CLUSTER_ID --query 'Cluster.MasterPublicDnsName'
   
2. Modify the Security Group associated with the EMR Cluster: Run the following AWS CLI command to identify the security group attached to the EMR Cluster:
   aws emr describe-cluster --cluster-id YOUR_CLUSTER_ID --query 'Cluster.SecurityGroups[0].Name'
   
3. Update the Security Group to remove the inbound rule allowing SSH (port 22) access from 0.0.0.0/0: Run the following AWS CLI command to revoke the ingress rule for port 22:
   aws ec2 revoke-security-group-ingress --group-id YOUR_SECURITY_GROUP_ID --protocol tcp --port 22 --cidr 0.0.0.0/0
   
4. Verify the Public IP has been removed: Run the following AWS CLI command to describe the cluster and confirm that the Master Node no longer has a public IP address:
   aws emr describe-cluster --cluster-id YOUR_CLUSTER_ID --query 'Cluster.MasterPublicDnsName'
   

1. Import the necessary libraries:

import boto3

2. Initialize the AWS client for EMR:

emr_client = boto3.client('emr', region_name='your_region')

3. Identify the EMR Cluster ID for the cluster with the Master Node having a public IP:

cluster_id = 'your_cluster_id'

4. Describe the cluster to get the current configuration:

response = emr_client.describe_cluster(ClusterId=cluster_id)

5. Check if the Master Public DNS Name is present in the response:

if 'MasterPublicDnsName' in response['Cluster']:
    # Disassociate the public IP from the Master Node
    emr_client.modify_instance_fleet(ClusterId=cluster_id, InstanceFleet={ 'InstanceFleetType': 'MASTER', 'TargetOnDemandCapacity': 1 })
    print("Public IP removed from Master Node successfully.")
else:
    print("Master Node does not have a public IP.")

6. Run the Python script to remediate the misconfiguration and remove the public IP from the Master Node of the EMR Cluster.

resource "aws_redshift_subnet_group" "PRIVATE_REDSHIFT_SUBNET_GROUP" {
  name       = "private-redshift-subnet-group"
  subnet_ids = [
    AWS_PRIVATE_SUBNET_ID_1, # replace with actual private subnet ID, e.g. "subnet-0123456789abcdef0"
    AWS_PRIVATE_SUBNET_ID_2, # optional additional private subnets
  ]

  tags = {
    Name = "private-redshift-subnet-group"
  }
}

resource "aws_redshift_cluster" "THIS_REDSHIFT_CLUSTER" {
  cluster_identifier          = "REDSHIFT_CLUSTER_IDENTIFIER"   # replace with your cluster identifier
  node_type                   = "NODE_TYPE"                     # e.g. "dc2.large"
  master_username             = "MASTER_USERNAME"               # e.g. "admin"
  master_password             = "MASTER_PASSWORD"               # use sensitive/TF vars in real code
  cluster_subnet_group_name   = aws_redshift_subnet_group.PRIVATE_REDSHIFT_SUBNET_GROUP.name
  publicly_accessible         = false                           # key setting: disables public IP
  # ...other required/desired arguments...
}

• publicly_accessible changes from true to false (or is set to false on create).
• The cluster is associated with aws_redshift_subnet_group.PRIVATE_REDSHIFT_SUBNET_GROUP that uses private subnets only.