title: Amazon EMR - missing ingress rule from EmrManagedMasterSecurityGroup on port 9443
body: <p>I am trying to get my head around this, but cannot figure it out why</p>
  <ol>
  <li>I have an EMR cluster to be deployed in AWS Private Subnet.</li>
  <li>I checked the documentation <a href="https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-man-sec-groups.html" rel="nofollow noreferrer">here</a>.</li>
  <li>From the above I understood the following:</li>
  </ol>
  <p>a. For my EMR <em>custom</em> security group, I DO NOT NEED to specify ingress rule for port 9443 i.e. it can be the same as the <code>ElasticMapReduce-Master-Private</code>. The following are my inbound/outbound rules for the EMR Managed Security Group for Master/Slave instances (<strong>NOT</strong> Service)</p>
  <p>Outbound<a href="https://i.stack.imgur.com/RGUhZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RGUhZ.png" alt="enter image description here" /></a></p>
  <p>Inbound<a href="https://i.stack.imgur.com/vwuIf.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vwuIf.jpg" alt="enter image description here" /></a></p>
  <p>b. For my custom service security group I can keep it the same as <code>ElasticMapReduce-ServiceAccess</code>, I need to specify ingress rule for port 9443 like the following (Terraform):</p>
  <pre><code>resource &quot;aws_security_group_rule&quot; &quot;allow_tcp_from_master_to_service&quot; {
    type                     = &quot;ingress&quot;
    from_port                = 9443
    to_port                  = 9443
    protocol                 = &quot;tcp&quot;
    security_group_id        = join(&quot;&quot;, aws_security_group.ml.*.id)
    source_security_group_id = join(&quot;&quot;, aws_security_group.ml_emr.*.id)
  
    lifecycle {
      create_before_destroy = false
    }
  }
  </code></pre>
  <p>But when I deploy this using terraform, I get the AWS error:</p>
  <pre><code>Error waiting for EMR Cluster state to be &quot;WAITING&quot; or &quot;RUNNING&quot;: TERMINATED_WITH_ERRORS: VALIDATION_ERROR: ServiceAccessSecurityGroup is missing ingress rule from EmrManagedMasterSecurityGroup on port 9443
  </code></pre>
  <p>I am struggling to understand why AWS is saying I need this when I don't? From the documentation it's not clear where this mentioned, so I would appreciate if someone could clarify what's expected here.</p>
  <p>Regards,</p>