AWS batch documentation change
Summary
Restructured tutorial with expanded steps for AWS Batch on EKS private clusters, added AWS CloudShell usage, ECR pull-through cache setup, IAM permission details, and network access configuration steps.
Security assessment
The changes emphasize secure access methods (AWS CloudShell), IAM policy requirements, and private network configurations. While these are security best practices, there is no explicit mention of addressing a specific vulnerability or security incident. The ECR pull-through cache reduces external dependencies, and CloudShell usage minimizes credential exposure, but these are presented as functional improvements rather than direct security fixes.
Diff
diff --git a/batch/latest/userguide/getting-started-eks-privateclusters.md b/batch/latest/userguide/getting-started-eks-privateclusters.md index da16eb85d..929ddf26f 100644 --- a//batch/latest/userguide/getting-started-eks-privateclusters.md +++ b//batch/latest/userguide/getting-started-eks-privateclusters.md @@ -5 +5 @@ -PrerequisitesPrepare your EKS cluster for AWS BatchCreate an Amazon EKS compute environmentCreate a job queue and attach the compute environmentCreate a job definitionSubmit a job(Optional) Submit a job with overridesTroubleshooting +OverviewPrerequisitesStep 1: Create your EKS cluster for AWS BatchStep 2: Prepare your EKS cluster for AWS BatchStep 3: Create an Amazon EKS compute environmentStep 4: Create a job queue and attach the compute environmentStep 5: Create an Amazon ECR with pull through cacheStep 6: Register a job definitionStep 7: Submit a job to runStep 8: View the Job's outputStep 9: (Optional) Submit a job with overridesStep 10: Clean up your tutorial resourcesAdditional resourcesTroubleshooting @@ -7 +7 @@ PrerequisitesPrepare your EKS cluster for AWS BatchCreate an Amazon EKS compute -# Tutorial: Getting started with AWS Batch on Amazon EKS Private Clusters +# Getting started with AWS Batch on Amazon EKS Private Clusters @@ -9 +9 @@ PrerequisitesPrepare your EKS cluster for AWS BatchCreate an Amazon EKS compute -AWS Batch is a managed service that orchestrates batch workloads in your Amazon Elastic Kubernetes Service (Amazon EKS) clusters. This includes queuing, dependency tracking, managed job retries and priorities, pod management, and node scaling. This feature connects your existing private Amazon EKS cluster with AWS Batch to run your jobs at scale. You can use [``eksctl``](https://eksctl.io/usage/eks-private-cluster/) (a command line interface for Amazon EKS), the AWS console, or the [AWS Command Line Interface](https://aws.amazon.com/cli/) to create a private Amazon EKS cluster with all the other necessary resources. Support for private Amazon EKS clusters on AWS Batch is generally available in [commercial AWS Regions where AWS Batch](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) is available. +AWS Batch is a managed service that orchestrates batch workloads in your Amazon Elastic Kubernetes Service (Amazon EKS) clusters. This includes queuing, dependency tracking, managed job retries and priorities, pod management, and node scaling. This feature connects your existing private Amazon EKS cluster with AWS Batch to run your jobs at scale. You can use [``eksctl``](https://eksctl.io/usage/eks-private-cluster/) (a command line interface for Amazon EKS), the AWS console, or the [AWS Command Line Interface](https://aws.amazon.com/cli/) to create a private Amazon EKS cluster with all the other necessary resources. @@ -11 +11 @@ AWS Batch is a managed service that orchestrates batch workloads in your Amazon -[Amazon EKS private only clusters](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html#private-access) have no inbound/outbound internet access, and only have private subnets. Amazon VPC endpoints are used to enable private access to other AWS services. `eksctl` supports creating fully private clusters using a pre-existing Amazon VPC and subnets. ``eksctl`` also creates Amazon VPC endpoints in the supplied Amazon VPC and modifies route tables for the supplied subnets. +[Amazon EKS private only clusters](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html#private-access) by default have no inbound/outbound internet access, and you can only access the API server from within your VPC or a connected network. Amazon VPC endpoints are used to enable private access to other AWS services. `eksctl` supports creating fully private clusters using a pre-existing Amazon VPC and subnets. ``eksctl`` also creates Amazon VPC endpoints in the supplied Amazon VPC and modifies route tables for the supplied subnets. @@ -18,0 +19,2 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co + * [Overview](./getting-started-eks-privateclusters.html#getting-started-eks-context) + @@ -21 +23,9 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co - * [Prepare your EKS cluster for AWS Batch](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-1) + * [Step 1: Create your EKS cluster for AWS Batch](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-0) + + * [Step 2: Prepare your EKS cluster for AWS Batch](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-1) + + * [Step 3: Create an Amazon EKS compute environment](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-2) + + * [Step 4: Create a job queue and attach the compute environment](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-3) + + * [Step 5: Create an Amazon ECR with pull through cache](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-ecr) @@ -23 +33 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co - * [Create an Amazon EKS compute environment](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-2) + * [Step 6: Register a job definition](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-4) @@ -25 +35 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co - * [Create a job queue and attach the compute environment](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-3) + * [Step 7: Submit a job to run](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-5) @@ -27 +37 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co - * [Create a job definition](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-4) + * [Step 8: View the Job's output](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-7) @@ -29 +39 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co - * [Submit a job](./getting-started-eks-privateclusters.html#getting-started-eks-step-5) + * [Step 9: (Optional) Submit a job with overrides](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-6) @@ -31 +41,3 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co - * [(Optional) Submit a job with overrides](./getting-started-eks-privateclusters.html#getting-started-eks-step-6) + * [Step 10: Clean up your tutorial resources](./getting-started-eks-privateclusters.html#getting-started-eks-privateclusters-step-8) + + * [Additional resources](./getting-started-eks-privateclusters.html#getting-started-eks-additional-resources) @@ -37,0 +50,49 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co +## Overview + +This tutorial demonstrates how to setup AWS Batch with a private Amazon EKS using the AWS CloudShell, `kubectl` and `eksctl`. + +**Intended Audience** + + +This tutorial is designed for system administrators and developers responsible for setting up, testing, and deploying AWS Batch. + +**Features Used** + + +This tutorial shows you how to use the AWS CLI, to: + + * Use Amazon Elastic Container Registry (Amazon ECR) to store container images + + * Create and configure an Amazon EKS compute environment + + * Create a job queue. + + * Create a job definition + + * Create and submit a job to run + + * Submit a job with overrides + + + + +**Time Required** + + +It should take about 40–50 minutes to complete this tutorial. + +**Regional Restrictions** + + +There are no country or regional restrictions associated with using this solution. + +**Resource Usage Costs** + + +There's no charge for creating an AWS account. However, by implementing this solution, you might incur some or all of the costs that are listed in the following table. + +Description | Cost (US dollars) +---|--- +You are charged by the cluster hour | Varies depending on Instance, see [Amazon EKS pricing](https://aws.amazon.com/eks/pricing/) +Amazon EC2 instance | You pay for each Amazon EC2 instance that is created. For more information about pricing, see [Amazon EC2 Pricing](https://aws.amazon.com/ec2/pricing/). + @@ -40 +101 @@ You can optionally create a [pull through cache rule](https://docs.aws.amazon.co -Before starting this tutorial, you must install and configure the following tools and resources that you need to create and manage both AWS Batch and Amazon EKS resources. You also need to create all the necessary resources including VPC, subnets, route tables, VPC endpoints, and Amazon EKS cluster. You need to use the AWS CLI. +This tutorial uses AWS CloudShell which is a browser-based, pre-authenticated shell that you launch directly from the AWS Management Console. This allows for access to the cluster once it no longer has public internet access. The AWS CLI, `kubectl`, and `eksctl` may already be installed as part of AWS CloudShell. For more information on AWS CloudShell, see the [AWS CloudShell _User Guide_](https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html). An alternative to AWS CloudShell is to connect to your cluster's VPC or a [connected network](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/introduction.html). @@ -42 +103 @@ Before starting this tutorial, you must install and configure the following tool - * AWS CLI – A command line tool to work with AWS services, including Amazon EKS. This guide requires that you use version 2.8.6 or later or 1.26.0 or later. For more information, see [Installing, updating, and uninstalling the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) in the _AWS Command Line Interface User Guide_. +To run kubectl commands, you will need private access to your Amazon EKS cluster. This means all traffic to your cluster API server must come from within your cluster's VPC or a connected network. @@ -44 +105 @@ Before starting this tutorial, you must install and configure the following tool -After installing the AWS CLI, we recommend that you configure it. For more information, see [Quick configuration with `aws configure`](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-config) in the _AWS Command Line Interface User Guide_. + * AWS CLI – A command line tool for working with AWS services, including Amazon EKS. This guide requires that you use version 2.8.6 or later or 1.26.0 or later. For more information, see [Installing, updating, and uninstalling the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) in the _AWS Command Line Interface User Guide_. After installing the AWS CLI, we recommend that you also configure it. For more information, see [Quick configuration with `aws configure`](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-config) in the _AWS Command Line Interface User Guide_. @@ -46 +107 @@ After installing the AWS CLI, we recommend that you configure it. For more infor - * `kubectl` – A command line tool to work with Kubernetes clusters. This guide requires that you use version `1.23` or later. For more information, see [Installing or updating `kubectl`](https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html) in the __Amazon EKS User Guide__. + * `kubectl` – A command line tool for working with Kubernetes clusters. This guide requires that you use version `1.23` or later. For more information, see [Installing or updating `kubectl`](https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html) in the _Amazon EKS User Guide_. @@ -48 +109 @@ After installing the AWS CLI, we recommend that you configure it. For more infor - * ``eksctl`` – A command line tool to work with Amazon EKS clusters that automates many individual tasks. This guide requires that you use version `0.115.0` or later. For more information, see [Installing or updating ``eksctl``](https://docs.aws.amazon.com/eks/latest/userguide/eksctl.html) in the __Amazon EKS User Guide__. + * ``eksctl`` – A command line tool for working with Amazon EKS clusters that automates many individual tasks. This guide requires that you use version `0.115.0` or later. For more information, see [Installing or updating ``eksctl``](https://eksctl.io/installation/) in the __Amazon EKS User Guide__. @@ -50 +111 @@ After installing the AWS CLI, we recommend that you configure it. For more infor - * Required AWS Identity and Access Management (IAM) permissions – The IAM security principal that you're using must have permissions to work with Amazon EKS IAM roles and service linked roles, AWS CloudFormation, and a VPC and related resources. For more information, see [Actions, resources, and condition keys for Amazon Elastic Kubernetes Service](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html) and [Using service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) in the _IAM User Guide_. You must complete all steps in this guide as the same user. + * Permissions – Users calling the [CreateComputeEnvironment](https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateComputeEnvironment.html) API operation to create a compute environment that uses Amazon EKS resources require permissions to the `eks:DescribeCluster` and `eks:ListClusters` API operation. You can attach the [AWSBatchFullAccess](./batch_managed_policies.html#batch_managed_policies.title) managed policy to your user account by following the directions [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the _IAM User Guide_. @@ -52 +113 @@ After installing the AWS CLI, we recommend that you configure it. For more infor - * Creating an Amazon EKS cluster – For more information, see [Getting started with Amazon EKS – `eksctl`](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html) in the __Amazon EKS User Guide__. + * InstanceRole – You need to create an `InstanceRole` for your Amazon EKS nodes that has the `AmazonEKSWorkerNodePolicy` and `AmazonEC2ContainerRegistryPullOnly` polices. For directions on how to create the `InstanceRole` see [Creating the Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html#create-worker-node-role). You will need the ARN of the `InstanceRole`. @@ -54 +115,3 @@ After installing the AWS CLI, we recommend that you configure it. For more infor -###### Note + * AWS account ID – You need to know your AWS account ID. Follow the directions in [Viewing your AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console-account-id.html). + + * (Optional) CloudWatch – To examine the details of [(Optional) Submit a job with overrides](./getting-started-eks.html#getting-started-eks-step-6), logging must be configured. For more information, see [Use CloudWatch Logs to monitor AWS Batch on Amazon EKS jobs](./batch-eks-cloudwatch-logs.html). @@ -56 +118,0 @@ After installing the AWS CLI, we recommend that you configure it. For more infor -AWS Batch doesn't provide managed node orchestration for CoreDNS or other deployment pods. If you need CoreDNS, see [Adding the CoreDNS Amazon EKS add-on](https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html#adding-coredns-eks-add-on) in the __Amazon EKS User Guide__. Or, use `eksctl create cluster create` to create the cluster, it includes CoreDNS by default. @@ -58 +119,0 @@ AWS Batch doesn't provide managed node orchestration for CoreDNS or other deploy - * Permissions – Users calling the [CreateComputeEnvironment](https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateComputeEnvironment.html) API operation to create a compute environment that uses Amazon EKS resources require permissions to the `eks:DescribeCluster` API operation. Using the AWS Management Console to create a compute resource using Amazon EKS resources requires permissions to both `eks:DescribeCluster` and `eks:ListClusters`. @@ -60 +121,12 @@ AWS Batch doesn't provide managed node orchestration for CoreDNS or other deploy - * Create a [private EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html) cluster in the us-east-1 region using the sample ``eksctl`` config file. + +## Step 1: Create your EKS cluster for AWS Batch + +###### Important + +To get started as simply and quickly as possible, this tutorial includes steps with default settings. Before creating for production use, we recommend that you familiarize yourself with all settings and deploy with the settings that meet your requirements. + +We recommend you use ``eksctl`` and the following config file to create your cluster. To manually setup your cluster follow the directions in [Deploy private clusters with limited internet access](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) in the _Amazon EKS User Guide_. + + 1. Open the [AWS CloudShell console](https://console.aws.amazon.com/cloudshell/home) and set the region to `us-east-1`. For the rest of the tutorial make sure you are using `us-east-1`. + + 2. Create a private EKS cluster in the `us-east-1` region using the sample ``eksctl`` config file. Save the yaml file to your AWS CloudShell environment and name it `clusterConfig.yaml` .You can change `my-test-cluster` with the name you want to use for your cluster. @@ -78 +150,5 @@ AWS Batch doesn't provide managed node orchestration for CoreDNS or other deploy -Create your resources using the command: `eksctl create cluster -f clusterConfig.yaml` + 3. Create your resources using the command: `eksctl create cluster -f clusterConfig.yaml`. Cluster creation can take between 10–15 minutes. + + 4. Once the cluster has finished being created you have to add your AWS CloudShell IP address to the allow list. To find your AWS CloudShell IP address run the following command: + + curl http://checkip.amazonaws.com @@ -80 +156 @@ Create your resources using the command: `eksctl create cluster -f clusterConfig - * Batch managed nodes must be deployed to subnets that have the VPC interface endpoints that you require. For more information, see [Private cluster requirements.](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) +Once you have the public IP address you have to create an allow list rule: @@ -81,0 +158,4 @@ Create your resources using the command: `eksctl create cluster -f clusterConfig + aws eks update-cluster-config \ + --name my-test-cluster \ + --region us-east-1 \ + --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=true,publicAccessCidrs=["<Public IP>/32"] @@ -82,0 +163 @@ Create your resources using the command: `eksctl create cluster -f clusterConfig +Then apply the update to the kubectl config file: @@ -83,0 +165 @@ Create your resources using the command: `eksctl create cluster -f clusterConfig + aws eks update-kubeconfig --name my-test-cluster --region us-east-1 @@ -85 +167 @@ Create your resources using the command: `eksctl create cluster -f clusterConfig -## Prepare your EKS cluster for AWS Batch + 5. To test that you have access to the nodes run the following command: @@ -87 +169,15 @@ Create your resources using the command: `eksctl create cluster -f clusterConfig -All steps are required. + kubectl get nodes + +The output of command is: + + NAME STATUS ROLES AGE VERSION + ip-192-168-107-235.ec2.internal Ready none 1h v1.32.3-eks-473151a + ip-192-168-165-40.ec2.internal Ready none 1h v1.32.3-eks-473151a + ip-192-168-98-54.ec2.internal Ready none 1h v1.32.1-eks-5d632ec + + + + +## Step 2: Prepare your EKS cluster for AWS Batch + +All steps are required and must be done in AWS CloudShell. @@ -115,4 +211,0 @@ Use `kubectl` to create a Kubernetes role for the cluster to allow AWS Batch to -###### Note - -For more information about using RBAC authorization, see [Using RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) in the _Kubernetes documentation_. - @@ -210,2 +304,2 @@ Update Kubernetes `aws-auth` configuration map to map the preceding RBAC permis - --cluster my-cluster-name \ - --arn "arn:aws:iam::<your-account>:role/AWSServiceRoleForBatch" \ + --cluster my-test-cluster \ + --arn "arn:aws:iam::<your-account-ID>:role/AWSServiceRoleForBatch" \ @@ -217 +311 @@ Output: - 2022-10-25 20:19:57 [ℹ] adding identity "arn:aws:iam::<your-account>:role/AWSServiceRoleForBatch" to auth ConfigMap + 2022-10-25 20:19:57 [ℹ] adding identity "arn:aws:iam::<your-account-ID>:role/AWSServiceRoleForBatch" to auth ConfigMap @@ -226 +320 @@ The path `aws-service-role/batch.amazonaws.com/` has been removed from the ARN o -## Create an Amazon EKS compute environment +## Step 3: Create an Amazon EKS compute environment @@ -231,0 +326,13 @@ Now that the **AWSServiceRoleForBatch** service-linked role has access to your A + * For `subnets` run `eksctl get cluster `my-test-cluster`` to get the subnets used by the cluster. + + * For `securityGroupIds` parameter you can use the same security group as the Amazon EKS cluster. This command retrieves the security group ID for the cluster.