Environment security groups

Depending on what you choose during environment creation, Cloudera can create security groups for your environment automatically, or you can provide your own security groups.

If you choose to use your own security groups, you are asked to create Knox and Default security groups as described in the Security groups documentation.
If you choose for Cloudera to create all security groups required for an environment, the following security groups are created:

FreeIPA

AWS naming convention: ${environment-name}-freeipa-${random-id}-ClusterNodeSecurityGroupmaster-${random-id}

Table 1. FreeIPAport requirements
Protocol	Port Range	Source	Description
TCP	22	Your CIDR.	This is an optional port for end-user SSH access to cluster hosts. You should open it to your organization’s CIDR.
TCP	9443	Cloudera CIDR .	This port is used by Cloudera to maintain management control of clusters and data lakes. This port is not used when the CCM is enabled.
TCP, UDP	0-65535	Your VPC’s CIDR (for example, 10.10.0.0/16) and your subnet’s CIDR (for example, 10.0.2.0/24).	This is required for internal communication within the VPC.
ICMP	N/A	Your internal VPC CIDR (for example, 10.10.0.0/16).	This is required for internal communication within the VPC.