Cloudera Docs

Cloudera Data Hub security groups

Depending on what you chose during environment creation, Cloudera can create security groups for your Data Hub clusters automatically, or it can use your pre-created security groups:

  • If, during environment creation, you provided your own security groups, Cloudera uses these security groups when deploying clusters.
  • If, during environment creation, you choose for Cloudera to create new security groups, new security groups are created for each Cloudera Data Hub cluster.

Cloudera Data Hub: master

AWS naming convention: ${cluster-name}-${random-i}-ClusterNodeSecurityGroupmaster-${random-id}

Table 1. Cloudera Data Hub: master port requirements
Protocol Port Range Source Description

TCP

22

Your CIDR.

This is an optional port for end-user SSH access to cluster hosts. You should open it to your organization’s CIDR.

TCP

443

Your CIDR and Cloudera CIDR.

This port is used to access the Cloudera Data Hub cluster UIs via the Knox gateway. You should open it to your organization’s CIDR in order to access cluster UIs.

When the CCM is enabled, you only need to set this to your CIDR.

TCP

9443

Cloudera CIDR

.

This port is used by Cloudera to maintain management control of clusters and data lakes.

This port is not used when Cluster Connectivity Manager is enabled.

TCP, UDP

0-65535

Your VPC’s CIDR (for example, 10.10.0.0/16) and your subnet’s CIDR (for example, 10.0.2.0/24).

This is required for internal communication within the VPC.

ICMP

N/A

Your internal VPC CIDR (for example, 10.10.0.0/16).

This is required for internal communication within the VPC.

Cloudera Data Hub: worker

AWS naming convention: ${cluster-name}-${random-id}-ClusterNodeSecurityGroupworker-${random-id}

Table 2. Cloudera Data Hub: worker port requirements
Protocol Port Range Source Description

TCP

22

Your CIDR.

This is an optional port for end-user SSH access to cluster hosts.

TCP, UDP

0-65535

Your VPC’s CIDR (for example, 10.10.0.0/16) and your subnet’s CIDR (for example, 10.0.2.0/24).

This is required for internal communication within the VPC.

ICMP

N/A

Your internal VPC CIDR (for example, 10.10.0.0/16).

This is required for internal communication within the VPC.

Cloudera Data Hub: compute

AWS naming convention: ${cluster-name}-${random-id}-ClusterNodeSecurityGroupcompute-${random-id}

Table 3. Cloudera Data Hub: compute port requirements
Protocol Port Range Source Description

TCP

22

Your CIDR.

This is an optional port for end-user SSH access to cluster hosts.

TCP, UDP

0-65535

Your VPC’s CIDR (for example, 10.10.0.0/16) and your subnet’s CIDR (for example, 10.0.2.0/24).

This is required for internal communication within the VPC.

ICMP

N/A

Your internal VPC CIDR (for example, 10.10.0.0/16).

This is required for internal communication within the VPC.