Is kerberos_attributes enforced for PCI DSS v4.0?

Yes, The access permissions and authorizations can be managed and incorporated with the principles of least privilege and separation of duties, by enabling Kerberos for AWS EMR clusters.

terraform-aws-modules/emr/aws for PCI DSS v4.0

Controls

4 controls from PCI DSS v4.0 apply to this module.

Control	Clause	Change
Log group retention period should be at least 365 dayscloudwatch_log_group_retention_period_365 None	None
EMR cluster Kerberos should be enabledemr_cluster_kerberos_enabled None	None
Log group encryption at rest should be enabledlog_group_encryption_at_rest_enabled None	None
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports 1.3.2	1.3.2