Project: KICS (Provisioning / Security & Compliance)
File: 5b033ec8-f079-4323-b5c8-99d4620433a9.md

title: EMR Security Configuration Encryption Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5b033ec8-f079-4323-b5c8-99d4620433a9 Query name: EMR Security Configuration Encryption Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: EMR SecurityConfiguration should enable and properly configure encryption at rest and in transit.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8 9" Resources: EMRSecurityConfiguration: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: EncryptionConfiguration: EnableInTransitEncryption: false EnableAtRestEncryption: false AtRestEncryptionConfiguration: LocalDiskEncryptionConfiguration: EnableEbsEncryption: true EncryptionKeyProviderType: AwsKms AwsKmsKey: arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="9 10" Resources: EMRSecurityConfiguration01: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: EncryptionConfiguration: AtRestEncryptionConfiguration: LocalDiskEncryptionConfiguration: EnableEbsEncryption: false ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="8 9" Resources: EMRSecurityConfiguration03: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: EncryptionConfiguration: EnableInTransitEncryption: false EnableAtRestEncryption: false ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="6" Resources: EMRSecurityConfiguration04: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: {} ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="9 10" { "Resources": { "EMRSecurityConfiguration": { "Type": "AWS::EMR::SecurityConfiguration", "Properties": { "Name": "String", "SecurityConfiguration": { "EncryptionConfiguration": { "EnableInTransitEncryption": false, "EnableAtRestEncryption": false, "AtRestEncryptionConfiguration": { "LocalDiskEncryptionConfiguration": { "EnableEbsEncryption": true, "EncryptionKeyProviderType": "AwsKms", "AwsKmsKey": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" } } } } } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="9 10" { "Resources": { "EMRSecurityConfiguration01": { "Properties": { "Name": "String", "SecurityConfiguration": { "EncryptionConfiguration": { "AtRestEncryptionConfiguration": { "LocalDiskEncryptionConfiguration": { "EnableEbsEncryption": false } } } } }, "Type": "AWS::EMR::SecurityConfiguration" } } } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="8 9" { "Resources": { "EMRSecurityConfiguration03": { "Type": "AWS::EMR::SecurityConfiguration", "Properties": { "SecurityConfiguration": { "EncryptionConfiguration": { "EnableInTransitEncryption": false, "EnableAtRestEncryption": false } }, "Name": "String" } } } } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="7" { "Resources": { "EMRSecurityConfiguration04": { "Type": "AWS::EMR::SecurityConfiguration", "Properties": { "Name": "String", "SecurityConfiguration": {} } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: EMRSecurityConfiguration: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: EncryptionConfiguration: EnableInTransitEncryption: true EnableAtRestEncryption: true AtRestEncryptionConfiguration: LocalDiskEncryptionConfiguration: EnableEbsEncryption: true EncryptionKeyProviderType: AwsKms AwsKmsKey: arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 ``` ```yaml title="Negative test num. 2 - yaml file" Resources: EMRSecurityConfiguration01: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: EncryptionConfiguration: AtRestEncryptionConfiguration: LocalDiskEncryptionConfiguration: EnableEbsEncryption: true EncryptionKeyProviderType: AwsKms AwsKmsKey: arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012 ``` ```yaml title="Negative test num. 3 - yaml file" Resources: EMRSecurityConfiguration02: Type: AWS::EMR::SecurityConfiguration Properties: Name: String SecurityConfiguration: EncryptionConfiguration: EnableInTransitEncryption: true EnableAtRestEncryption: true ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "Resources": { "EMRSecurityConfiguration": { "Type": "AWS::EMR::SecurityConfiguration", "Properties": { "Name": "String", "SecurityConfiguration": { "EncryptionConfiguration": { "EnableInTransitEncryption": true, "EnableAtRestEncryption": true, "AtRestEncryptionConfiguration": { "LocalDiskEncryptionConfiguration": { "AwsKmsKey": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012", "EnableEbsEncryption": true, "EncryptionKeyProviderType": "AwsKms" } } } } } } } } ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "Resources": { "EMRSecurityConfiguration01": { "Type": "AWS::EMR::SecurityConfiguration", "Properties": { "Name": "String", "SecurityConfiguration": { "EncryptionConfiguration": { "AtRestEncryptionConfiguration": { "LocalDiskEncryptionConfiguration": { "EnableEbsEncryption": true, "EncryptionKeyProviderType": "AwsKms", "AwsKmsKey": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" } } } } } } } } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "Resources": { "EMRSecurityConfiguration02": { "Properties": { "Name": "String", "SecurityConfiguration": { "EncryptionConfiguration": { "EnableInTransitEncryption": true, "EnableAtRestEncryption": true } } }, "Type": "AWS::EMR::SecurityConfiguration" } } } ``` </details>