Access open source component web UIs | EMR - E-MapReduce

EMR clusters disable web UI ports of open source components such as Hadoop, Spark, and Flink for security. You can access these web UIs through a native UI address, a Knox proxy address, local port forwarding, or dynamic port forwarding.

Quick selection

Access web UIs through addresses in the EMR console or by creating an SSH tunnel. Choose a method based on your needs, network environment, and security requirements.

Scenario	Recommended method	Description
High security requirements	Use the internal Knox proxy address to access the web UIs of open source components	Centralized management and security control for internal enterprise use.
Access from external users or remote machines	Use the external Knox proxy address to access the web UIs of open source components	External access with high security. Knox provides authentication and authorization.
Convenient access from internal users	Use the native UI address to access the web UIs of open source components	Quick access from an internal network. Ensure the internal network is secure and reliable.
Flexible access to multiple open source components	Access via dynamic port forwarding	Flexible access to multiple open source components across various network environments.

Method comparison

Method type	Method	Pros and cons	Limitations
EMR console	Use the native UI address to access the web UIs of open source components	Advantages: Direct access without additional configuration. Internal-only access with high security. Disadvantages: No external access. Requires enabling component-specific ports.	Your client must be in the same internal network as the EMR cluster nodes.
	Use the internal or external Knox proxy address to access the web UIs of open source components	Internal Knox proxy address Advantages: Only port 8443 required in the cluster security group. Internal-only access with identity authentication for high security. Disadvantages: Complex configuration. No external access.	Your client must be in the same internal network as the EMR cluster nodes. Knox must be deployed in the cluster. Only specific open source components are supported. Note This method is currently supported for the following services: YARN, HDFS, Spark 2, Spark 3, Flink, HBase, Impala, Trino, Presto, Tez, and Ranger.
		External Knox proxy address Advantages: Only port 8443 required in the cluster security group. Suitable for remote access to component web UIs. Identity authentication with high security. Disadvantages: Complex configuration.	Your client must connect to the EMR cluster master node. Knox must be deployed in the cluster. Only specific open source components are supported. Note This method is currently supported for the following services: YARN, HDFS, Spark 2, Spark 3, Flink, HBase, Impala, Trino, Presto, Tez, and Ranger.
SSH tunnel	Access via local port forwarding	Advantages: Supports SSL-encrypted data transmission. Simple command-line setup. Disadvantages: Your client must connect to the EMR cluster master node over SSH. Requires enabling multiple ports in the cluster security group.	Your client must connect to the EMR cluster master node. Job details cannot be viewed.
SSH tunnel	Access via dynamic port forwarding	Advantages: Supports SSL-encrypted data transmission. Access multiple component web UIs through a single port. Disadvantages: Complex configuration. Your client must connect to the EMR cluster master node over SSH.	Your client must connect to the EMR cluster master node.