My understanding of the EMR Managed Security Group Documentation is that on creation of a cluster, an inbound rule to SSH from any IP to Master on port 22 is added.
SSH TCP 22 (public subnets only) 0.0.0.0/0
Allows inbound access to the master node via SSH from any IP address. This rule can be edited to limit access to individual IP addresses or address ranges.
However, I find that is not the case. I had to create an additional security group with SSH on port 22 and specify that in my cluster creation step.
Have I misunderstood the documentation? My concern is that I didn't correctly use the default security group and my 'additional security group' is a hack