Add certificates from ACM to be used by Spark on EMR

The approach you're describing for adding custom certificates to be used by Spark on EMR is workable, but there are some considerations and potential improvements to make:

1. Instead of downloading certificates from ACM directly on the EMR cluster, it's generally recommended to store the certificates in AWS Secrets Manager. This provides better security and easier management of sensitive information.

2. For the permission denied error, you're likely encountering this because the AWS CLI command is being run as a non-root user. You can resolve this by using sudo for the aws command as well, or by redirecting the output to a file in a directory where the current user has write permissions.

3. Converting PEM files to P12 and then importing into the Java keystore (JKS) is a valid approach. However, you might consider using the newer PKCS12 format instead of JKS, as it's the recommended format for newer Java versions.

4. Regarding your PS about using a custom truststore breaking access to S3 and other AWS services: You can avoid this by merging your custom certificates with the default Java cacerts. This way, you maintain access to AWS services while adding your custom certificates.

Here's an improved version of your approach:

1. Store your certificates in AWS Secrets Manager instead of ACM.
2. In your bootstrap script, retrieve the certificates from Secrets Manager.
3. Save the certificates to appropriate files.
4. Use keytool to import the certificates directly into a copy of the default Java cacerts, adding your custom certificates without removing the defaults.

This approach should allow you to automate the process while maintaining access to AWS services. When certificates are updated in Secrets Manager, you can simply re-run the bootstrap script or create a new EMR cluster to apply the changes.

To validate that your certificates are in the correct format, you can use the openssl command:

openssl x509 -in <PEM FILE> -text

This will display the certificate details if it's in the correct format.

Remember to handle the certificates and private keys securely throughout this process, and ensure that your EMR instances have the necessary permissions to access Secrets Manager.
Sources
Store TLS certificates in AWS Secrets Manager - Amazon EMR
Certificate and key format for importing - AWS Certificate Manager