AWS parallelcluster documentation change
Summary
Restructured PCUI installation documentation, added detailed stack parameters section, and updated formatting of region-specific quick-create links.
Security assessment
The changes add documentation for security-related stack parameters including IAM permissions boundaries (PermissionsBoundaryPolicy), VPC endpoint restrictions (VpcEndpointId), Lambda security groups/subnets, and certificate requirements (CognitoCustomDomainCertificateArn). However, there is no evidence these changes address a specific vulnerability or incident - they document existing security configuration options.
Diff
diff --git a/parallelcluster/latest/ug/install-pcui-v3.md b/parallelcluster/latest/ug/install-pcui-v3.md index 00cab04b7..be74581ed 100644 --- a//parallelcluster/latest/ug/install-pcui-v3.md +++ b//parallelcluster/latest/ug/install-pcui-v3.md @@ -5 +5 @@ -Install the PCUI +Install the PCUIStack parameters @@ -25,0 +26,2 @@ For more information, see [Setting up an AWS account](./install-v3.html#setting- + * Stack parameters + @@ -39 +41 @@ For more information, see [Setting up an AWS account](./install-v3.html#setting- -To install an instance of the AWS ParallelCluster UI (PCUI), you choose an AWS CloudFormation quick-create link for the AWS Region that you create clusters in. The quick-create URL takes you to a **Create Stack Wizard** where you provide quick-create stack template inputs and deploy the stack. For more information about CloudFormation quick-create stacks, see [Creating quick-create links for stacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stacks-quick-create-links.html) in the _AWS CloudFormation User Guide_. +To install an instance of the AWS ParallelCluster UI (PCUI), choose an AWS CloudFormation quick-create link for the AWS Region in which you create clusters. The quick-create URL takes you to a **Create Stack Wizard** where you provide quick-create stack template inputs and deploy the stack. For more information about CloudFormation quick-create stacks, see [Creating quick-create links for stacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stacks-quick-create-links.html) in the _AWS CloudFormation User Guide_. @@ -45,24 +47 @@ You can only create and edit clusters or build images with the same AWS Parallel -### PCUI quick-create links by Region - -UI quick-create links ---- -[us-east-1](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[us-east-2](https://us-east-2.console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[us-west-1](https://us-west-1.console.aws.amazon.com/cloudformation/home?region=us-west-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[us-west-2](https://us-west-2.console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[eu-west-1](https://eu-west-1.console.aws.amazon.com/cloudformation/home?region=eu-west-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[eu-west-2](https://eu-west-2.console.aws.amazon.com/cloudformation/home?region=eu-west-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[eu-west-3](https://eu-west-3.console.aws.amazon.com/cloudformation/home?region=eu-west-3#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[eu-central-1](https://eu-central-1.console.aws.amazon.com/cloudformation/home?region=eu-central-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[eu-north-1](https://eu-north-1.console.aws.amazon.com/cloudformation/home?region=eu-north-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[me-south-1](https://me-south-1.console.aws.amazon.com/cloudformation/home?region=me-south-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[sa-east-1](https://sa-east-1.console.aws.amazon.com/cloudformation/home?region=sa-east-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[ca-central-1](https://ca-central-1.console.aws.amazon.com/cloudformation/home?region=ca-central-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[ap-northeast-1](https://ap-northeast-1.console.aws.amazon.com/cloudformation/home?region=ap-northeast-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[ap-northeast-2](https://ap-northeast-2.console.aws.amazon.com/cloudformation/home?region=ap-northeast-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[ap-south-1](https://ap-south-1.console.aws.amazon.com/cloudformation/home?region=ap-south-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[ap-southeast-1](https://ap-southeast-1.console.aws.amazon.com/cloudformation/home?region=ap-southeast-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[ap-southeast-2](https://ap-southeast-2.console.aws.amazon.com/cloudformation/home?region=ap-southeast-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) -[us-gov-west-1](https://console.amazonaws-us-gov.com/cloudformation/home?region=us-gov-west-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) - -###### Use an AWS CloudFormation quick-create link to deploy an PCUI stack with nested Amazon Cognito, API Gateway, and Amazon EC2 Systems Manager stacks. +###### Use an AWS CloudFormation quick-create link to deploy a PCUI stack with nested Amazon Cognito, API Gateway, and Amazon EC2 Systems Manager stacks. @@ -72 +51,37 @@ UI quick-create links - 2. Deploy the PCUI by choosing an AWS Region quick-create link from the table at the start of this section. This takes you to the CloudFormation **Create Stack Wizard** in the console. + 2. Deploy the PCUI by choosing an AWS Region quick-create link from the list here. This takes you to the CloudFormation **Create Stack Wizard** in the console. + + * [us-east-1](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [us-east-2](https://us-east-2.console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [us-west-1](https://us-west-1.console.aws.amazon.com/cloudformation/home?region=us-west-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [us-west-2](https://us-west-2.console.aws.amazon.com/cloudformation/home?region=us-west-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [eu-west-1](https://eu-west-1.console.aws.amazon.com/cloudformation/home?region=eu-west-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [eu-west-2](https://eu-west-2.console.aws.amazon.com/cloudformation/home?region=eu-west-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [eu-west-3](https://eu-west-3.console.aws.amazon.com/cloudformation/home?region=eu-west-3#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [eu-central-1](https://eu-central-1.console.aws.amazon.com/cloudformation/home?region=eu-central-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [eu-north-1](https://eu-north-1.console.aws.amazon.com/cloudformation/home?region=eu-north-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [me-south-1](https://me-south-1.console.aws.amazon.com/cloudformation/home?region=me-south-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [sa-east-1](https://sa-east-1.console.aws.amazon.com/cloudformation/home?region=sa-east-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [ca-central-1](https://ca-central-1.console.aws.amazon.com/cloudformation/home?region=ca-central-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [ap-northeast-1](https://ap-northeast-1.console.aws.amazon.com/cloudformation/home?region=ap-northeast-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [ap-northeast-2](https://ap-northeast-2.console.aws.amazon.com/cloudformation/home?region=ap-northeast-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [ap-south-1](https://ap-south-1.console.aws.amazon.com/cloudformation/home?region=ap-south-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [ap-southeast-1](https://ap-southeast-1.console.aws.amazon.com/cloudformation/home?region=ap-southeast-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [ap-southeast-2](https://ap-southeast-2.console.aws.amazon.com/cloudformation/home?region=ap-southeast-2#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) + + * [us-gov-west-1](https://console.amazonaws-us-gov.com/cloudformation/home?region=us-gov-west-1#/stacks/create/review?stackName=parallelcluster-ui&templateURL=https://parallelcluster-ui-release-artifacts-us-east-1.s3.us-east-1.amazonaws.com/parallelcluster-ui.yaml) @@ -76 +91 @@ UI quick-create links -After deployment completes successfully, the PCUI sends you a temporary password to this email address. You use the temporary password to access the PCUI. If you delete the email before you save or use the temporary password, you must delete the stack and reinstall the PCUI. +After deployment completes successfully, the PCUI will send a temporary password to this email address that you can use to access the PCUI. If you delete the email before you save or use the temporary password, you must delete the stack and reinstall the PCUI. @@ -88 +103 @@ After deployment completes successfully, the PCUI sends you a temporary password - 9. After the deployment completes, open the admin email that was sent to the address you entered. It contains a temporary password that you use to access the PCUI. If you permanently delete the email and you haven’t yet logged in to the PCUI, you must delete the PCUI stack you created and reinstall the PCUI. + 9. After the deployment completes, open the admin email that was sent to the address you entered and that contains the temporary password. Use that to access the PCUI. (Remember, if you permanently delete the email before you log in to the PCUI, you must delete the PCUI stack you created and reinstall the PCUI. @@ -92 +107 @@ After deployment completes successfully, the PCUI sends you a temporary password - 11. In **Stack details** , choose **Outputs** and select the link for the key named **`Stackname`URL** to open the PCUI. **`Stackname`** is the name that you noted in a previous step. + 11. In **Stack details** , choose **Outputs** and select the link for the key named **`Stackname`URL** to open the PCUI (where **`Stackname`** is the name that you noted in a previous step). @@ -94 +109 @@ After deployment completes successfully, the PCUI sends you a temporary password - 12. Enter the temporary password. Follow the steps to create your own password and log in. + 12. Enter the temporary password. Follow the steps to create your own password and log in again. @@ -105 +120,191 @@ After deployment completes successfully, the PCUI sends you a temporary password -PCUI sessions have a default duration of 5 minutes, which is the minimum value provided by Cognito as of PCUI 2023.12.0. Hence, it is expected that a user removed from Cognito User Pools is still able to access the system until the session expires. +PCUI sessions have a default duration of 5 minutes, which is the minimum value provided by Cognito as of PCUI 2023.12.0. So, it is expected that a user removed from Cognito User Pools will still able to access the system until the session expires. + +## Stack parameters + +**AdditionalPoliciesPCAPI:** + + +Description: (Optional) ARN of the additional IAM policy to be attached to the default execution role for the ParallelCluster Lambda function. Only one policy can be specified. + +Type: String + +Default: '' + +AllowedPattern: "^(arn:.*:iam::.*:policy\\\/([a-zA-Z0-9_-]+))|()$" + +**AdminUserEmail:** + + +Description: Email address of administrative user to setup by default (only with new Cognito instances). + +Type: String + +Default: '' + +**CognitoCustomDomain:** + + +Description: (Optional) Custom domain name for Cognito. If omitted, the default Cognito domain name will be used. + +Type: String + +Default: '' + +**CognitoCustomDomainCertificateArn:** + + +Description: (Optional) ARN of the ACM Certificate issued for the Cognito custom domain. This is required only if `CognitoCustomDomain` is specified. + +Type: String + +Default: '' + +**CustomDomain:** + + +Description: (Optional) Custom domain name. If omitted, the default domain name will be used. + +Type: String + +Default: '' + +**CustomDomainCertificateArn:** + + +Description: (Optional) ARN of the ACM Certificate issued for the custom domain. This is required only if `CustomDomain` is specified. + +Type: String + +Default: '' + +**IAMRoleAndPolicyPrefix:** + + +Description: Prefix applied to the name of every IAM role and policy (max length: 10). [ParallelCluster >= 3.8.0] + +Type: String + +Default: '' + +MaxLength: 10 + +**ImageBuilderSubnetId:** + + +Description: (Optional) Select the subnet to use for building the container images. The subnet must be public and auto-assign public IPs. If not selected, the default Subnet will be used. + +Type: String + +Default: '' + +**ImageBuilderVpcId:** + + +Description: (Optional) Select the VPC to use for building the container images. If not selected, the default VPC will be used. + +Type: String + +Default: '' + +**InfrastructureBucket:** + + +Description: (Optional) S3 bucket where CloudFormation files are stored. Change this parameter only when testing changes made to the infrastructure itself. + +Type: String + +Default: '' + +**LambdaSecurityGroupIds:** + + +Description: Comma separated list of security groups to be associated with the PCUI Lambda function. + +Type: CommaDelimitedList + +Default: '' + +**LambdaSubnetIds:**