how to write to EMR's HDFS from outside the VPC - hadoop

Question

I'm trying to write to HDFS on EMR from an external client that's outside the VPC. The following error is thrown:
Caused by: org.apache.hadoop.ipc.RemoteException(java.io.IOException): File /user/sdc/temperature-humidity/2018-03-22-04/_tmp_sdc-5bb89fd7-1b80-11e8-95f0-251c07cb2860_0 could only be replicated to 0 nodes instead of minReplication (=1). There are 2 datanode(s) running and 2 node(s) are excluded in this operation.
at org.apache.hadoop.hdfs.server.blockmanagement.BlockManager.chooseTarget4NewBlock(BlockManager.java:1735)
at org.apache.hadoop.hdfs.server.namenode.FSDirWriteFileOp.chooseTargetForNewBlock(FSDirWriteFileOp.java:265)
at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.getAdditionalBlock(FSNamesystem.java:2561)
at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.addBlock(NameNodeRpcServer.java:829)
at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.addBlock(ClientNamenodeProtocolServerSideTranslatorPB.java:510)
at org.apache.hadoop.hdfs.protocol.proto.ClientNamenodeProtocolProtos$ClientNamenodeProtocol$2.callBlockingMethod(ClientNamenodeProtocolProtos.java)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:447)
at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:989)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:847)
at org.apache.hadoop.ipc.Server$RpcCall.run(Server.java:790)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1836)
at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2486)
at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1554)
at org.apache.hadoop.ipc.Client.call(Client.java:1498)
at org.apache.hadoop.ipc.Client.call(Client.java:1398)
at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:233)
at com.sun.proxy.$Proxy102.addBlock(Unknown Source)
at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolTranslatorPB.addBlock(ClientNamenodeProtocolTranslatorPB.java:459)
at sun.reflect.GeneratedMethodAccessor212.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:291)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:203)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:185)
at com.sun.proxy.$Proxy103.addBlock(Unknown Source)
at org.apache.hadoop.hdfs.DFSOutputStream$DataStreamer.locateFollowingBlock(DFSOutputStream.java:1574)
at org.apache.hadoop.hdfs.DFSOutputStream$DataStreamer.nextBlockOutputStream(DFSOutputStream.java:1369)
at org.apache.hadoop.hdfs.DFSOutputStream$DataStreamer.run(DFSOutputStream.java:558)
The job creates empty files on hdfs:
$ hdfs dfs -ls -R /user/sdc/temperature-humidity
drwxr-xr-x - sdc sdc 0 2018-03-22 15:06 /user/sdc/temperature-humidity/2018-03-22-15
-rw-r--r-- 3 sdc sdc 0 2018-03-22 15:04 /user/sdc/temperature-humidity/2018-03-22-15/sdc-5bb89fd7-1b80-11e8-95f0-251c07cb2860_343b936c-e72f-4ba0-8dd3-6c2ccf819cd8
I notice that the datanodes are using internal names and private IP's:
hdfs$ hdfs dfsadmin -report | grep -i name
Name: 172.31.11.201:50010 (ip-172-31-11-201.us-east-2.compute.internal)
Hostname: ip-172-31-11-201.us-east-2.compute.internal
Name: 172.31.3.174:50010 (ip-172-31-3-174.us-east-2.compute.internal)
Hostname: ip-172-31-3-174.us-east-2.compute.internal
I suspect that the client can talk to the namenode because it has a public DNS. It creates the file entry in the namespace, but then fails to write the data to the datanodes because the the namenode tells the client to write to their internal names which aren't resolvable outside the VPC, e.g.
Q) how can I configure my EMR and/or client so it can write to the EMR HDFS from ouside the VPC?