AWS pcs high security documentation change
Summary
Updated Slurm version support policy, EOL notification process, and security patch management details. Added explicit warnings about cluster suspension for EOL versions with security vulnerabilities.
Security assessment
The changes explicitly mention automatic application of patches to address Slurm CVEs (security vulnerabilities) and state clusters may be suspended if security vulnerabilities are found in EOL versions. This directly addresses security risks and provides guidance to maintain security compliance.
Diff
diff --git a/pcs/latest/userguide/slurm-versions_faq.md b/pcs/latest/userguide/slurm-versions_faq.md index 784b6e818..07170d6e4 100644 --- a//pcs/latest/userguide/slurm-versions_faq.md +++ b//pcs/latest/userguide/slurm-versions_faq.md @@ -7,9 +7 @@ -###### How long does AWS PCS support a Slurm version? - -AWS PCS follows the SchedMD support cycles for major versions. AWS PCS supports up to 3 major versions at any given time. After SchedMD releases a new major version, AWS PCS retires the oldest supported version. AWS PCS releases a new major version of Slurm as soon as possible, but there might be a delay between the SchedMD release and its availability in AWS PCS. - -###### When does AWS PCS notify me about the End of Support Life (EOSL) for Slurm versions? - -AWS PCS notifies you multiple times, in a pre-determined cadence, before the EOSL date. - -###### What do I have to do when a Slurm version approaches EOSL? +AWS PCS maintains support for multiple Slurm versions. When a new Slurm version is introduced, AWS PCS provides technical support and security patches until that version reaches its end of support (EOS) from SchedMD. AWS PCS refers to the EOS date for a Slurm version as end of life (EOL) to be consistent with AWS terminology. @@ -17,3 +9 @@ AWS PCS notifies you multiple times, in a pre-determined cadence, before the EOS -You must update your Slurm versions before EOSL to help maintain a secure and supported environment. - -###### How can I update my clusters to use a new major version of Slurm? +###### How long does AWS PCS support a Slurm version? @@ -21 +11 @@ You must update your Slurm versions before EOSL to help maintain a secure and su -To update the Slurm version, you must create a new cluster. You must also upgrade to the equivalent AWS PCS software in your Amazon Machine Image (AMI) and use it to create the compute node groups for your new cluster. +AWS PCS support for Slurm versions aligns with SchedMD’s support cycles for major versions. AWS PCS supports the current version and the 2 most recent previous major versions. When SchedMD releases a new major version, AWS PCS ends support for the oldest supported version. AWS PCS releases new major versions of Slurm as soon as possible but there might be a delay between SchedMD's release and its availability in AWS PCS. @@ -23 +13 @@ To update the Slurm version, you must create a new cluster. You must also upgrad -###### How will my clusters get new Slurm patch version releases? +###### How do my clusters get new Slurm patch version releases? @@ -25 +15 @@ To update the Slurm version, you must create a new cluster. You must also upgrad -AWS PCS is designed to automatically apply patches to address Slurm Common Vulnerabilities and Exposures (CVEs). AWS PCS applies the patches to cluster controllers that run in internal service-owned accounts. To install patches on EC2 instances in your AWS account, update the AMI for your compute node groups and update the compute node groups to use the updated AMI. For more information, see [Custom Amazon Machine Images (AMIs) for AWS PCS](./working-with_ami_custom.html). +To address bugs and security fixes, AWS PCS is designed to automatically apply patches to cluster controllers that run in internal service-owned accounts. To install patches on EC2 instances in your AWS account, update the Amazon Machine Image (AMI) for your compute node groups and update the compute node groups to use the updated AMI. For more information, see [Custom Amazon Machine Images (AMIs) for AWS PCS](./working-with_ami_custom.html). @@ -29,5 +19 @@ AWS PCS is designed to automatically apply patches to address Slurm Common Vulne -Slurm controllers are unavailable while we update them. Running jobs aren't affected. Jobs submitted when the cluster's controller is unavailable are held until the controller is available. - -###### What if I don’t update Slurm by the EOSL date? - -AWS PCS is designed to stop clusters that have an unsupported Slurm version. You must update the Slurm major version of the cluster controller and the AWS PCS software installed on the compute node groups. +Slurm controllers are unavailable while we update them. Running jobs aren't affected. Jobs submitted before the cluster's controller became unavailable are held until the controller is available. @@ -35 +21 @@ AWS PCS is designed to stop clusters that have an unsupported Slurm version. You -###### How many Slurm versions does AWS PCS support? +###### How am I informed about an upcoming Slurm version EOL event? @@ -37 +23 @@ AWS PCS is designed to stop clusters that have an unsupported Slurm version. You -AWS PCS supports up to 3 major Slurm versions at any given time, including the current and 2 previous major versions. +We send you an email message 6 months before the EOL date. We send you an email message each month before the EOL, with a final email message 1 week before the EOL date. After the EOL date, we send monthly email messages for 12 months to customers running AWS PCS clusters with EOL Slurm versions. We might suspend a cluster with an EOL Slurm version if security vulnerabilities are identified for that version. @@ -39 +25 @@ AWS PCS supports up to 3 major Slurm versions at any given time, including the c -###### What Slurm version updates should I apply? +###### How can I determine if the Slurm version used by my cluster is running an EOL Slurm version? @@ -41 +27 @@ AWS PCS supports up to 3 major Slurm versions at any given time, including the c -We strongly recommend you use the same major version across all components in your cluster and install the latest patches as soon as they are released. The AMIs for your compute node groups must use a version of Slurm software compatible with the Slurm version of the cluster controller. The Slurm major version in your AMIs must be within 2 versions of the Slurm major version on the cluster controller. The Slurm version installed in the AMI and on the running EC2 instances in the cluster can’t be newer than the Slurm version on the cluster controller. To maintain support for your cluster, your AMIs must use a supported AWS PCS software version. +We send you an email message to notify you that you have a running cluster with an EOL Slurm version. We post an alert to the AWS Health Dashboard alerts that contains the details of your clusters with EOL Slurm versions. You can also use the AWS PCS console to identify the clusters with EOL Slurm versions. @@ -43 +29 @@ We strongly recommend you use the same major version across all components in yo -###### What if I update the Slurm major version but use older Slurm software in my AMI for compute node groups? +###### What do I have to do if my Slurm version is near or beyond EOL? @@ -45 +31 @@ We strongly recommend you use the same major version across all components in yo -You must update the AWS PCS software to the same version to use new Slurm functionality. For full AWS PCS support, all Slurm components must use supported versions. In summary: +Create a new cluster with a newer supported version of Slurm and update the Slurm version in your compute node group AMIs. The Slurm version in your AMIs and running EC2 instances can’t be more than 2 versions behind the cluster’s Slurm version. For more information, see [Custom Amazon Machine Images (AMIs) for AWS PCS](./working-with_ami_custom.html). @@ -47 +33 @@ You must update the AWS PCS software to the same version to use new Slurm functi - * We are able to provide full support when the cluster controller and all components (AWS PCS packages) in your AWS account both use the supported versions. +###### What will happen if I don’t switch to a newer version of Slurm by the EOL date? @@ -49 +35 @@ You must update the AWS PCS software to the same version to use new Slurm functi - * AWS PCS is designed to stop a cluster if the Slurm version of its controller reaches EOSL. +You can’t create new clusters with an EOL Slurm version. Existing clusters can operate for up to 12 months without AWS support, and no immediate action is required to maintain their operation. After the EOL date, support, security updates, and availability are not guaranteed. We might suspend a cluster for security reasons. We strongly recommend you use a supported Slurm version to maintain security and support for your AWS PCS clusters. @@ -51 +37 @@ You must update the AWS PCS software to the same version to use new Slurm functi - * If the Slurm version of components in your AWS account reach EOSL, your cluster won’t be supported. +###### What are the risks of operating a cluster with EOL Slurm versions? @@ -52,0 +39 @@ You must update the AWS PCS software to the same version to use new Slurm functi +Clusters with EOL Slurm versions present significant security and operational risks. Without SchedMD's active monitoring, security vulnerabilities might remain undetected or unaddressed. If critical vulnerabilities are discovered, we might suspend your clusters immediately. @@ -53,0 +41 @@ You must update the AWS PCS software to the same version to use new Slurm functi +###### What happens to my jobs, cluster compute, storage and networking resources when my cluster is suspended? @@ -54,0 +43 @@ You must update the AWS PCS software to the same version to use new Slurm functi +All resources managed by AWS PCS are terminated. This includes the Slurm controller, compute node groups, and EC2 instances. Any jobs running on compute instances are immediately terminated, and the cluster enters a suspended state. Customer-managed resources, such as external file systems, remain intact. You can use the AWS PCS console and API actions to access the cluster's configuration. @@ -56 +45 @@ You must update the AWS PCS software to the same version to use new Slurm functi -###### In what order should I update components in my Cluster? +###### Can I restart a suspended cluster to resume its remaining jobs? @@ -58 +47 @@ You must update the AWS PCS software to the same version to use new Slurm functi -You must update the Slurm version of your cluster controller before you use an AMI with a newer Slurm version. You update a compute node group to use the AMI. AWS PCS uses the AMI to launch new EC2 instances in the compute node group. AWS PCS doesn't update existing EC2 instances that have running jobs; AWS PCS is designed to terminate those instances after their jobs complete. +No, you can’t restart a suspended cluster. You can use your suspended cluster’s configuration to create a new cluster with a supported Slurm version. You can run your remaining jobs if you saved them in an external file system. @@ -60 +49 @@ You must update the Slurm version of your cluster controller before you use an A -###### Does AWS PCS offer extended support for Slurm versions? +###### Can I request an extension beyond the 12-month grace period? @@ -62 +51 @@ You must update the Slurm version of your cluster controller before you use an A -No. We will communicate detailed information about extended support options, including any additional costs and the specific support coverage provided. +No, you can’t request an extension to run your cluster beyond the 12-month grace period. We provide the extended time to help you switch to a supported Slurm version. To avoid disruption to your cluster operations, we recommend you switch before your Slurm version reaches EOL.