AWS parallelcluster documentation change
Summary
Clarified customer responsibilities for OS package updates and Lambda role configuration
Security assessment
The updates emphasize customer responsibility for verifying kernel/component compatibility during OS updates, which is a security best practice but does not address a specific vulnerability. Minor wording changes to Lambda role documentation do not introduce security content.
Diff
diff --git a/parallelcluster/latest/ug/Build-v3.md b/parallelcluster/latest/ug/Build-v3.md index 1a67dc010..1c93c527b 100644 --- a//parallelcluster/latest/ug/Build-v3.md +++ b//parallelcluster/latest/ug/Build-v3.md @@ -124 +124 @@ Specifies an instance role to override the default instance role for the EC2 Ima -The ARN of the IAM role to use for the AWS Lambda function backing the AWS CloudFormation custom resource that removes build artifacts on build completion. Lambda needs to be configured as the principal allowed to assume the role. The format is `arn:`Partition`:iam::`Account`:role/`RoleName``. +The ARN of the IAM role to use for the AWS Lambda function that backs the AWS CloudFormation custom resource that removes build artifacts on build completion. Lambda needs to be configured as the principal allowed to assume the role. The format is `arn:`Partition`:iam::`Account`:role/`RoleName``. @@ -164 +164 @@ Specifies the type of the type-value pair for the component. Type can be `arn` o -Specifies the value of the type-value pair for the component. When type is `arn`, this is the ARN of a EC2 Image Builder component. When type is `script`, this is the https or s3 link pointing to the script to use when creating the EC2 Image Builder component. +Specifies the value of the type-value pair for the component. When type is `arn`, this is the ARN of a EC2 Image Builder component. When type is `script`, this is the https or s3 link that points to the script to use when you create the EC2 Image Builder component. @@ -204 +204 @@ If `true`, the OS is updated and rebooted before installing the AWS ParallelClus -When `UpdateOsPackages` is enabled, all available OS packages are updated, including the kernel. As a customer, you are responsible for verifying that the update is compatible with the AMI dependencies that aren't included in the update. +When `UpdateOsPackages` is enabled, all available OS packages are updated, including the kernel. As a customer, it is your responsibility to verify that the update is compatible with the AMI dependencies that aren't included in the update. @@ -206 +206 @@ When `UpdateOsPackages` is enabled, all available OS packages are updated, inclu -For example, suppose you're building an AMI for AWS ParallelCluster version X.0 that's shipped with kernel version Y.0 and some component version Z.0. Suppose the available update includes updated kernel version Y.1 without updates to component Z.0. Before you enable `UpdateOsPackages`, it's your responsibility to verify that component Z.0 supports kernel Y.1. +For example, suppose you want to build an AMI for AWS ParallelCluster version X.0 that's shipped with kernel version Y.0 and some component version Z.0. Suppose the available update includes updated kernel version Y.1 without updates to component Z.0. Before you enable `UpdateOsPackages`, it's your responsibility to verify that component Z.0 supports kernel Y.1.