How to add a security group and security group rules - E-MapReduce

A security group is a virtual firewall that controls network access and provides security isolation for ECS instances in your cluster. You can add instances to security groups and configure security group rules to manage access.

Background information

When you create an EMR cluster, you can use an existing security group or create a new one to control inbound and outbound traffic for all ECS instances in the group. You can organize instances into different security groups based on their function. For example, security groups created by EMR are EMR security groups, and your pre-existing groups are user security groups. Each security group can have its own set of access control rules.

For more information about how to create a security group, see Create a security group.

Limits

For the classic network type, an instance must be added to a security group of the classic network type in the same region.
For the VPC network type, an instance must be added to a security group in the same VPC.

Notes

When you add a security group rule, always restrict the source IP address range. Do not use 0.0.0.0/0 to prevent potential attacks.
When you add security group rules, follow the principle of least privilege. For the authorization object, grant access only from your current public IP address. You can find your current public IP address by visiting IP Address.
Do not use enterprise security groups created on the ECS console for your EMR cluster.
The EMR service uses the 100.64.0.0/10 CIDR block and internal VIP ranges of Object Storage Service (OSS) to provide control plane services to EMR clusters. Do not block traffic from these ranges in your cluster security group. For more information, see Access OSS by using endpoints and bucket domain names.

You are responsible for any EMR service failures caused by improper security group configurations.
When you configure security group rules for an EMR cluster, ensure that all ECS instances in the cluster can communicate with each other over the internal network. Otherwise, big data services in the cluster will be disrupted.

Add an instance to a security group

Go to the Nodes page.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group.
3. On the Clusters page, find the cluster and click Nodes in the Actions column.
Go to the security group list page.
1. On the Nodes page, click the icon to the left of a node group.
2. Click the ID of the ECS instance.
3. On the instance details page, click the Security Group tab.
On the Security Groups page, click Add to Security Group.
In the Add to Security Group dialog box, select a security group from the Security Group list.

To add the ECS instance to multiple security groups, select a security group and click Add to Batch Selection. This adds the group to the selection pane. Repeat this process to add other security groups.
Click OK.

Repeat Step 2 to Step 4 to add the other ECS instances in the EMR cluster to the appropriate security groups.

Add a security group rule

Obtain your public IP address.

To securely access cluster components, allow traffic only from your current public IP address in the security group rule. You can find your current public IP address by visiting IP Address.
Go to the security group page.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group.
3. On the Clusters page, click the ID of the cluster.
4. On the Basic Information page, click the link next to Cluster Security Group.

On the Security Group Rules page, click Add Rule and configure the rule.

Set the Port Range and Authorization Object. You can keep the default values for the other parameters. For more information, see Add a security group rule.

Parameter	Description
Port number range	The port to open on the ECS instance for access.
Authorization Object	The public IP address that you obtained in Step 1. Important To prevent security risks, do not set the Authorization Object to 0.0.0.0/0.

Click Save.