AWS parallelcluster documentation change
Summary
Minor grammatical improvements and rephrasing of API deployment documentation. Clarifies IAM role requirements for Lambda functions and security implications of EnableIamAdminAccess parameter.
Security assessment
Changes are primarily grammatical improvements and clarifications of existing security concepts (like IAM role permissions). No new security vulnerabilities or features are introduced. The EnableIamAdminAccess documentation maintains existing security guidance without adding new warnings or mitigations.
Diff
diff --git a/parallelcluster/latest/ug/api-reference-deploy-v3.md b/parallelcluster/latest/ug/api-reference-deploy-v3.md index 001928087..66aea9762 100644 --- a//parallelcluster/latest/ug/api-reference-deploy-v3.md +++ b//parallelcluster/latest/ug/api-reference-deploy-v3.md @@ -29 +29 @@ Run the following commands to deploy the API: -You can customize the API deployment by using the AWS CloudFormation parameters exposed by the template. To configure the value of a parameter when deploying through the CLI, the following option can be used: `--parameters ParameterKey=KeyName,ParameterValue=Value`. +You can use the AWS CloudFormation parameters exposed by the template to customize the API deployment. To configure the value of a parameter when you deploy through the CLI, the following option can be used: `--parameters ParameterKey=KeyName,ParameterValue=Value`. @@ -35 +35 @@ The following parameters are optional: - * **ParallelClusterFunctionRole** \- This overrides the IAM role that gets assigned to the AWS Lambda function implementing AWS ParallelCluster features. The parameter accepts the ARN of an IAM role. This role needs to be configured to have AWS Lambda as the IAM principal. Also, since this role will replace the default role of the API Lambda function, it must have at least the default permissions required by the API as listed in [AWS ParallelCluster example pcluster user policies](./iam-roles-in-parallelcluster-v3.html#iam-roles-in-parallelcluster-v3-example-user-policies). + * **ParallelClusterFunctionRole** \- This overrides the IAM role that gets assigned to the AWS Lambda function that implements AWS ParallelCluster features. The parameter accepts the ARN of an IAM role. This role needs to be configured to have AWS Lambda as the IAM principal. Also, since this role will replace the default role of the API Lambda function, it must have at least the default permissions required by the API as listed in [AWS ParallelCluster example pcluster user policies](./iam-roles-in-parallelcluster-v3.html#iam-roles-in-parallelcluster-v3-example-user-policies). @@ -45 +45 @@ You can configure custom domain settings to enforce a minimum version of Transpo - * **EnableIamAdminAccess** \- By default the AWS Lambda function processing AWS ParallelCluster API operations is configured with an IAM role that prevents any privileged IAM access (`EnableIamAdminAccess=false`). This makes the API unable to process operations that require the creation of IAM roles or policies. Because of this, the creation of clusters or custom images is successful only when IAM roles are provided as input as part of the resource configuration. + * **EnableIamAdminAccess** \- By default the AWS Lambda function that processes AWS ParallelCluster API operations is configured with an IAM role that prevents any privileged IAM access (`EnableIamAdminAccess=false`). This makes the API unable to process operations that require the creation of IAM roles or policies. Because of this, the creation of clusters or custom images is successful only when IAM roles are provided as input as part of the resource configuration. @@ -51 +51 @@ When `EnableIamAdminAccess` is set to `true` the AWS ParallelCluster API is gran -When this is set to true it grants IAM admin privileges to the AWS Lambda function processing AWS ParallelCluster operations. +When this is set to true it grants IAM admin privileges to the AWS Lambda function that processes AWS ParallelCluster operations. @@ -53 +53 @@ When this is set to true it grants IAM admin privileges to the AWS Lambda functi -Refer to [AWS ParallelCluster user example policies for managing IAM resources](./iam-roles-in-parallelcluster-v3.html#iam-roles-in-parallelcluster-v3-user-policy-manage-iam) for additional details on the features that can be unlocked when enabling this mode. +Refer to [AWS ParallelCluster user example policies for managing IAM resources](./iam-roles-in-parallelcluster-v3.html#iam-roles-in-parallelcluster-v3-user-policy-manage-iam) for additional details on the features that can be unlocked when you enable this mode.