EMR clster patching without SSM patch manger
We're currently running EMR clusters with release version 6.10.0 where instances are patched using SSM "AWS-RunPatchBaseline" during bootstrap. We're experiencing several critical issues: cluster failures when primary nodes reboot during patching, SSM throttling with large clusters (affecting scalability), and extended cluster launch times (>10 minutes). Given EMR's recommendation to move away from SSM-based patching, we're evaluating two alternatives:
- upgrading to EMR 7.x with AL2023 (which uses locked repositories and automatic security updates without SSM patching), or
- implementing a custom AMI approach.
Could you help us understand the trade-offs between these approaches, specifically around security updates, patching mechanisms, and cluster stability?
If we choose EMR 7.x with AL2023, does it require any additional patching during bootstrap, or will security updates be automatically included when the cluster is created? Also, how does the AL2023 locked repository mechanism handle ongoing security updates compared to our current SSM patching processon emr 6.x?
- Language
- English
- Newest
- Most votes
- Most comments
Based on your described issues, I recommend moving to EMR 7.x with AL2023 because:
It directly addresses your current pain points:
- Eliminates SSM throttling
- Reduces cluster launch times
- Improves cluster stability
- Removes primary node reboot issues
Provides a more sustainable long-term solution:
- Aligned with AWS's recommended approach
- Built-in security update mechanism
- Reduced operational overhead
- Better scalability characteristics
Migration Path:
- Start with test workloads
- Validate application compatibility
- Gradually migrate production workloads
- Monitor for any AL2023-specific considerations
The AL2023 approach offers a better balance of security, stability, and operational efficiency compared to both your current SSM-based approach and a custom AMI solution.
Remember to test extensively with your specific workloads before making the switch, as EMR 7.x might have some behavioral differences from 6.x that could affect your applications.
Relevant content
- asked 2 years ago
