EMR.2: EMR account-level block public access is off

What does AWS Security Hub EMR.2 check?

EMR.2 checks whether EMR block public access (BPA) is enabled for your account, Region by Region (resource type `AWS::::Account`). It reports FAILED when BPA is off, or when any port other than 22 is permitted as a public-access exception.

Why does EMR.2 matter?

BPA refuses to launch a cluster in a public subnet whose security group opens any port to `0.0.0.0/0` or `::/0`. EMR clusters routinely process customer records, financial transactions, and logs, so a single open security-group rule turns that into an internet-facing target. Because the setting is account- and Region-scoped, it protects every cluster anyone in the account tries to launch, not just one resource, which is why it's rated Critical.

How do I fix EMR.2?

1. Inspect the current BPA configuration and any exceptions in the failing Region.
2. Understand why it was disabled before changing it. BPA is on by default, so a failure usually means someone turned it off deliberately.
3. Re-enable BPA with port 22 as the only exception (and prefer reaching SSH via a bastion, not the open internet).
4. Lock it in across every Region and account so it can't drift again.

# Close the highest-impact public exposure first: databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --no-publicly-accessible --apply-immediately
  echo "$db: public access removed"
done

# Ratchet S3 shut at the account level so no bucket can be made public again.
aws s3control put-public-access-block --account-id 123456789012 \
  --public-access-block-configuration \
    'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'