Setup CSE-KMS - Amazon EMR

Setup CSE-KMS

You can enable client-side encryption using AWS KMS (CSE-KMS) in two primary scopes:

  • The first is cluster-wide configuration:

    [
  {
    "Classification":"core-site",
    "Properties": {
       "fs.s3a.encryption.algorithm": "CSE-KMS",
       "fs.s3a.encryption.key":"${KMS_KEY_ID}",
    }
  }
]
    Note

    If the AWS KMS key region is different than the S3 bucket/EMR region, you must set the following additional configuration: fs.s3a.encryption.cse.kms.region=${KMS_REGION}.

  • The second is job or application-specific configuration. CSE-KMS can be setup for a specific Spark application as follows:

    spark-submit --conf spark.hadoop.fs.s3a.encryption.algorithm=CSE-KMS --conf spark.hadoop.fs.s3a.encryption.key=${KMS_KEY_ID}