VPC and subnets

When registering an AWS environment in Cloudera, you will be asked to select a VPC and two or more subnets. You can use your existing VPC and subnets for provisioning Cloudera resources.

You need to verify the limits of the VPC and subnets available in your AWS account to ensure that you have enough resources to create clusters in Cloudera.

If you want to use your own AWS VPC, it must meet the following requirements:

The VPC has at least two subnets, each in a different availability zone.
If you plan to expose your cluster via a public load balancer, you need to have at least one public and one private subnet in the same availability zone, and your cluster must be deployed to one of those subnets.
The VPC subnets must be connected to an Internet Gateway OR a NAT Gateway. The VPC should be able to make an outbound connection with the internet or a set of CIDRs and ports provided by Cloudera.
Cloudera supports public subnets and private subnets. For private subnets, you must enable Cluster Connectivity Manager.

warning

Be careful if deploying into an existing subnet that has a non-default Network Access Control List (NACL) applied to it. In such a case, a security group at EC2 level and an NACL at the subnet level are both present at the same time. This can cause a problem because the two settings are evaluated independently (For incoming traffic, the NACL set at the subnet level is evaluated first, then the security group set at the EC2 level. For outgoing traffic, the evaluation is the converse), and if an "allow" rule does not exist at both levels, the traffic will not be admitted. Therefore, if you need to use such a setup, you should ensure that the "allow" rule exists on both levels.

Ensure the CIDR block for the subnets is sized appropriately. In general, there is no way to increase the subnet size without recreating the environment and VPC, although Cloudera Data Warehouse service allows you to use overlay networks.
When using Cluster Connectivity Manager on AWS, you have an option to use Public Endpoint Access Gateway. Using it requires at least 2 public subnets in the VPC. The exact number of public subnets should be equal to the number of private subnets. Furthermore, the availability zones of the public and private subnets must match.