title: Ports for Master and slave security groups in AWS EMR
body: <p>I am working in a highly regulated and secure Financial organization. We are using AWS EMR 5.20.
  We use transient/persistent EMR clusters. <em><strong>Due to Security/Architecture constraints, we can't keep the entire port range open as Architecture review board objects</strong></em>. We generally use single master and core nodes(no task node). We have one security group for master and one security group for slave(core).
  <strong>AWS is not providing us the specific ports that we should keep open.</strong>
  Master and slave nodes needs to communicate with each other so we have kept &quot;All TCP&quot; ports(0-65K), UDP ports(0-65K), All ICMP(0-65K) plus port 8443(TCP)- which is for master node communication with cluster manager. Each entry in the security group for master and slave contains source for master/slave so that master and slave can communicate.
  I tried opening some more ports for master as per <a href="https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-web-interfaces.html" rel="nofollow noreferrer">this</a></p>
  <p>It's all hit and trial for us as we see the open source hadoop ports, cloudera hadoop ports etc..and try out provisioning EMR cluster. But we are failing. When EMR master node doesn't comes up, then we can't even use the VPC flow logs to see which traffic is being rejected.
  Is somebody else also using this kind of configuration? How you are able to achieve these kind of constraints?
  Our EMR cluster runs in private VPC.</p>