Specifying Amazon S3 encryption using EMRFS properties

To specify EMRFS encryption options using the AWS Management Console

1. Navigate to the new Amazon EMR console and select Switch to the old console from the side navigation. For more information on what to expect when you switch to the old console, see Using the old console.

2. Choose Create cluster, Go to advanced options.

3. Choose a Release of 4.7.2 or earlier.

4. Choose other options for Software and Steps as appropriate for your application, and then choose Next.

5. Choose settings in the Hardware and General Cluster Settings panes as appropriate for your application.

6. On the Security pane, under Authentication and encryption, select the S3 Encryption (with EMRFS) option to use.

   Note

   S3 server-side encryption with KMS Key Management (SSE-KMS) is not available when using Amazon EMR release version 4.4 or earlier.

   • If you choose an option that uses AWS Key Management, choose an AWS KMS Key ID. For more information, see Using AWS KMS keys for EMRFS encryption.

   • If you choose S3 client-side encryption with custom materials provider, provide the Class name and the JAR location. For more information, see Amazon S3 client-side encryption.

7. Choose other options as appropriate for your application and then choose Create Cluster.

To add the EC2 instance profile for Amazon EMR to the list of encryption key users

1. Sign in to the AWS Management Console and open the AWS Key Management Service (AWS KMS) console at https://console.aws.amazon.com/kms.

2. To change the AWS Region, use the Region selector in the upper-right corner of the page.

3. Select the alias of the KMS key to modify.

4. On the key details page under Key Users, choose Add.

5. In the Add key users dialog box, select the appropriate role. The name of the default role is EMR_EC2_DefaultRole.

6. Choose Add.

To create a cluster with SSE-S3 enabled using the AWS CLI

• Type the following command:

  aws emr create-cluster --release-label emr-4.7.2 or earlier \
  --instance-count 3 --instance-type m5.xlarge --emrfs Encryption=ServerSide

To create a cluster with SSE-KMS enabled using the AWS CLI

• Type the following AWS CLI command to create a cluster with SSE-KMS, where keyID is an AWS KMS key, for example, a4567b8-9900-12ab-1234-123a45678901:

  aws emr create-cluster --release-label emr-4.7.2 or earlier --instance-count 3 \
  --instance-type m5.xlarge --use-default-roles \
  --emrfs Encryption=ServerSide,Args=[fs.s3.serverSideEncryption.kms.keyId=keyId]

  --OR--

  Type the following AWS CLI command using the emrfs-site classification and provide a configuration JSON file with contents as shown similar to myConfig.json in the example below:

  aws emr create-cluster --release-label emr-4.7.2 or earlier --instance-count 3 --instance-type m5.xlarge --applications Name=Hadoop --configurations file://myConfig.json --use-default-roles
  

  Example contents of myConfig.json:

  [
    {
      "Classification":"emrfs-site",
      "Properties": {
         "fs.s3.enableServerSideEncryption": "true",
         "fs.s3.serverSideEncryption.kms.keyId":"a4567b8-9900-12ab-1234-123a45678901"
      }
    }
  ]