Protecting your cluster from security vulnerabilities
Historically, each version of EMR was provided with an AMI, on which it was tested. In addition, on provisioning the image, it automatically checks the repository for security updates. You can only disable that behavior using repo-upgrade-on-boot=NONE
. Remember that when using a custom AMI, you must take the responsibility of keeping the image patched. However, patches that affect the kernel require a restart to be installed. Thus, in the past, you had two options:
- Upgrade to a newer version of EMR, which means taking upgrades in all components and services. This could cause your application to need to be retested and would potentially require a migration.
- Indicate EMR to use a newer AMI and risk running the services on an image on which it has never been tested.
That has changed since EMR 5.36 and 6.6, if using EMR 5 or 6, respectively. From those versions onwards, you can let EMR upgrade the AMI automatically...