All Products
Search

This Product

    E-MapReduce:Manage network connections

    Document Center

    E-MapReduce:Manage network connections

    Last Updated:Aug 28, 2026

    Network connections allow EMR Serverless Spark to access data sources, servers, and other services in your own virtual private cloud (VPC). This topic describes how to create a network connection and how to configure security group rules for the target service.

    Prerequisites

    A Serverless Spark workspace is created. For more information, see Create a workspace.

    Usage limits

    vSwitches are supported only in the following availability zones.

    • Mainland China

      Region name

      Region ID

      Availability zone name

      China (Hangzhou)

      cn-hangzhou

      • Zone H

      • Zone I

      • Zone J

      China (Shanghai)

      cn-shanghai

      • Zone L

      • Zone F

      • Zone G

      China (Beijing)

      cn-beijing

      • Zone F

      • Zone G

      • Zone H

      • Zone I

      • Zone K

      China (Shenzhen)

      cn-shenzhen

      • Zone E

      • Zone F

      China (Hong Kong)

      cn-hongkong

      • Zone B

      • Zone C

    • Other Countries and Regions

      Region name

      Region ID

      Availability zone name

      Germany (Frankfurt)

      eu-central-1

      • Zone A

      • Zone B

      Indonesia (Jakarta)

      ap-southeast-5

      • Zone A

      • Zone B

      Singapore

      ap-southeast-1

      • Zone B

      • Zone C

      US (Virginia)

      us-east-1

      • Zone A

      • Zone B

      US (Silicon Valley)

      us-west-1

      • Zone A

      • Zone B

      Japan (Tokyo)

      ap-northeast-1

      • Zone B

      • Zone C

      Mexico (Queretaro)

      na-south-1

      Zone A

      Philippines (Manila)

      ap-southeast-6

      • Zone A

      • Zone B

    Create a network connection

    1. Go to the Network Connection page.

      1. Log on to the EMR console.

      2. In the left navigation pane, choose EMR Serverless > Spark.

      3. On the Spark page, click the target workspace name.

      4. On the EMR Serverless Spark page, in the left navigation pane, click Normal Network Connection.

    2. On the Normal Network Connection page, click Create Network Connection.

    3. In the Create Network Connection dialog box, configure the following parameters and click OK.

      Parameter

      Description

      Name

      Enter a name for the connection.

      VPC

      Select the same VPC as the EMR cluster.

      If no VPC is available, click Create VPC to create one in the VPC console. For more information, see VPCs and vSwitches.

      Note

      If your Serverless Spark application needs internet access, ensure that the network connection provides it. For example, you can deploy a public NAT gateway in the VPC to enable internet access for Serverless Spark instances. For more information, see Public NAT Gateway.

      vSwitch

      Select a vSwitch that is in the same VPC as the EMR cluster.

      If no vSwitch is available in the current zone, click vSwitch to create one in the VPC console. For more information, see Create and manage vSwitches.

      Important

      You can select vSwitches only in specific zones. For more information, see Usage limits.

      The network connection is created when Status changes to Succeeded.

      image

    Configure security group rules

    After you create a network connection, you must allow the CIDR block of the vSwitch used by the connection in the security group of the cluster that hosts the target service. Otherwise, Serverless Spark cannot access the service. The following steps use an EMR on ECS cluster as an example.

    1. Obtain the CIDR block of the vSwitch specified in the network connection.

      Log on to the VPC console and go to the vSwitch page to obtain the CIDR block of the vSwitch.

    2. Add a security group rule.

      1. Log on to the EMR on ECS console.

      2. On the EMR on ECS page, click the cluster ID of the target cluster.

      3. On the Basic Information page, in the Security section, click the link next to Cluster Security Group.

      4. On the Security Group Details page, in the Rules section, click Add Rule, configure the following parameters, and then click OK.

        Parameter

        Description

        Protocol

        The type of network protocol to allow. Default value: TCP.

        Note

        If your network connection is used for Kerberos authentication, we recommend that you select UDP and open port 88. For more information about Kerberos authentication, see Enable Kerberos authentication.

        Source

        Enter the vSwitch CIDR block that you obtained in the previous step.

        Important

        To avoid security risks such as attacks from external users, do not set Authorization Object to 0.0.0.0/0.

        Destination (Current Instance)

        The destination port to open. For example, 9083.

    What to do next

    After you create a network connection and configure security group rules, you can select the network connection in an SQL session, a notebook session, or a batch job to access data sources in the VPC. For an end-to-end example that accesses a Hive Metastore in your own VPC, see Read from and write to HMS.