Securing data in Amazon EMR
With Amazon EMR, you can use a security configuration to specify settings for encrypting data at rest, data in transit, or both. When you enable at-rest data encryption, you can choose to encrypt EMRFS data in Amazon S3, data in local disks, or both. Each security configuration you create is stored in Amazon EMR rather than the cluster configuration, so you can easily reuse a configuration to specify data encryption settings whenever you create a cluster. As shown in the below diagram, several encryption mechanisms are enabled with in-transit encryption.
The preceding diagram shows that Amazon S3 encryption works with EMR File System (EMRFS) objects read from and written to Amazon S3. You specify Amazon S3 server-side encryption (SSE) or client-side encryption (CSE) as the Default encryption mode when you enable encryption at rest. Whether Amazon S3 encryption is enabled, Transport Layer Security (TLS...