EMR Security Update

To address security issues in an older version of Amazon EMR and update the program of your EMR cluster, there are several approaches you can consider:

1. Use the latest EMR release version: It's highly recommended to use the most recent EMR release version unless you have specific compatibility requirements. Each new release includes security updates and improvements. If possible, migrate your applications to the latest release in your series (e.g., if you're using 5.12.x, upgrade to the latest 5.12.x version).

2. Enable automatic updates and Relaunch your cluster: For newer EMR versions, you can enable the "Automatically apply latest Amazon Linux updates" option when creating a cluster. This ensures that the latest security updates are applied automatically when a new instance is added to the cluster at launch time or when scaling out. For clusters that run for extended periods, you may choose to periodically relaunch them to apply security updates in the instances/nodes of the cluster. This approach ensures that the latest security patches are applied to your cluster instances.

3. Test and install select security updates: For running cluster instances, you can test and then install specific security updates as needed. This approach allows for more targeted updates without necessarily rebooting the entire cluster. You may use SSM patching to automate these and apply across all instances on a cluster.

4. Use a custom AMI: If you need more control over the software and security configurations, you can create and use a custom Amazon Machine Image (AMI) for your EMR clusters. This allows you to pre-install security updates and configure the environment according to your specific requirements.

When implementing these updates, ensure that your networking configuration allows HTTP and HTTPS egress to Linux repositories in Amazon S3, as this is necessary for security updates to succeed.

Remember to thoroughly test any changes in a non-production environment before applying them to your production EMR clusters to ensure compatibility and stability.
Sources
Security in Amazon EMR - Amazon EMR
3 - Security | AWS Open Data Analytics
EMR Cluster - Automatically apply latest Amazon Linux Updates - is there an API call for setting updates | AWS re:Post