An EMR Cluster with Kerberos On, Which security_mode NORMAL Quietly Is Not
An E-MapReduce cluster with security_mode KERBEROS, because NORMAL is the default and a NORMAL cluster comes up, answers on YARN and HDFS, runs Spark, and never checks that a submitter is who they say they are. Both disk encryption flags are on, deletion protection is on, and spot instances on a MASTER or CORE group are refused.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "emr_cluster" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-emr-cluster/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-emr-cluster
A managed Spark and Hadoop cluster on Alibaba Cloud E-MapReduce. Works with Terraform and
OpenTofu (>= 1.6), alicloud provider >= 1.0, < 2.0.
security_mode NORMAL means nothing authenticates anybody, and it is the default. The cluster comes up, YARN answers, Spark submits work - what is missing is any check that the submitter is who they say they are.
Both disks are unencrypted by default and they are separate flags. The data disk is the one holding HDFS.
A spot node group loses its nodes with two minutes of warning, which is right for TASK and wrong for CORE; spot on a MASTER or CORE group is refused.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-database-migration
A DTS instance and synchronization job with delay_notice on, since a job that has fallen behind reports the same RUNNING as one that has not. Structure, data and synchronization are three separate required flags and the module names what each leaves out. The provider does not mark the endpoint passwords sensitive, so these variables do.
alicloud-maxcompute
A MaxCompute project with allow_full_scan off, so a query with no partition predicate fails rather than quietly reading the whole table and billing per byte - the single most effective cost control MaxCompute has, and the one people turn on after the invoice. Storage encryption is a creation-time choice, and an unset IP white list admits every address rather than none.
alicloud-tablestore
A Tablestore instance whose accessed_by is Vpc rather than the Any the API defaults to, so an AccessKey and the public endpoint are not enough to read it, plus the tables you declare - each with server-side encryption on, which cannot be added later, and each naming a time to live, because a table set to never expire grows forever.
alicloud-redis
An ApsaraDB for Redis instance in your VPC with the replica in a second zone, TLS required, the security_ips allow-list written from your ranges (0.0.0.0/0 by name), a password from a secret store never output, transparent encryption with your KMS key (the service's by name), daily backups, a maintenance window, and release protection on. Pay-as-you-go.
alicloud-elasticsearch
An Elasticsearch cluster on the current node-configuration blocks rather than the deprecated flat fields. enable_kibana_public_network defaults to true in this provider and is false here, the search endpoint is private, the data disks are encrypted, and an empty private whitelist is refused because Alibaba reads it as every address that can reach the VPC.
alicloud-rds-postgresql
security_ips is the whole allow list and the console's first suggestion is 0.0.0.0/0; ssl_action defaults to Close, so clients speak plain TCP; the SQL audit log and connection logging are off; Basic edition is one node; and deletion protection is off. Ranges required (a /0 by name), SSL open, 180 days of audit log, connection logging on, a standby zone, deletion protection on.