AWS batch documentation change
Summary
Restructured tutorial with step-by-step wizard guidance, added prerequisites, resource costs, execution role creation details, public IP configuration notes, and cleanup instructions
Security assessment
Added documentation about creating an IAM execution role (BatchEcsTaskExecutionRole) and security considerations for public IP assignment. While these are security-related configurations, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/batch/latest/userguide/getting-started-fargate.md b/batch/latest/userguide/getting-started-fargate.md index 48301a5b7..68095c2df 100644 --- a//batch/latest/userguide/getting-started-fargate.md +++ b//batch/latest/userguide/getting-started-fargate.md @@ -5 +5 @@ -Create a compute environmentCreate a job queueCreate a job definitionCreate a jobReview and create +OverviewPrerequisitesStep 1: Create a compute environmentStep 2: Create a job queueStep 3: Create a job definitionStep 4: Create a jobStep 5: Review and createStep 6: View the Job's outputStep 7: Clean up your tutorial resourcesAdditional resources @@ -7 +7 @@ Create a compute environmentCreate a job queueCreate a job definitionCreate a jo -# Tutorial: Getting started with AWS Batch and Fargate orchestration +# Getting started with AWS Batch and Fargate orchestration using the Wizard @@ -11 +11 @@ AWS Fargate launches and scales the compute to closely match the resource requir -## Create a compute environment +## Overview @@ -13 +13 @@ AWS Fargate launches and scales the compute to closely match the resource requir -To create a compute environment for a Fargate orchestration, do the following: +This tutorial demonstrates how to setup AWS Batch with the Wizard to configure AWS Fargate and run `Hello World`. @@ -15 +15 @@ To create a compute environment for a Fargate orchestration, do the following: - 1. Open the [AWS Batch console first-run wizard](https://console.aws.amazon.com/batch/home#wizard). +**Intended Audience** @@ -17 +16,0 @@ To create a compute environment for a Fargate orchestration, do the following: - 2. For **Select orchestration type** , choose **Fargate**. @@ -19 +18 @@ To create a compute environment for a Fargate orchestration, do the following: - 3. Choose**Next**. +This tutorial is designed for system administrators and developers responsible for setting up, testing, and deploying AWS Batch. @@ -21 +20 @@ To create a compute environment for a Fargate orchestration, do the following: - 4. In the **Compute environment configuration** section for **Name** , specify a unique name for your compute environment. The name can be up to 128 characters in length. It can contain uppercase and lowercase letters, numbers, hyphens (-), and underscores (_). +**Features Used** @@ -23 +21,0 @@ To create a compute environment for a Fargate orchestration, do the following: - 5. (Optional) A tag is a label that's assigned to a resource. To add a tag, expand **Tags** , then choose **Add tag**. Enter a key-value pair, and then choose **Add tag** again. @@ -25 +23,19 @@ To create a compute environment for a Fargate orchestration, do the following: -###### Important +This tutorial shows you how to use the AWS Batch console wizard to: + + * Create and configure an AWS Fargate compute environment + + * Create a job queue. + + * Create a job definition + + * Create and submit a job to run + + * View the output of the job in CloudWatch + + + + +**Time Required** + + +It should take about 10–15 minutes to complete this tutorial. @@ -27 +43 @@ To create a compute environment for a Fargate orchestration, do the following: -If you choose **Add tag** , you must enter a key-value pair and choose **Add tag** again or choose **Remove tag**. +**Regional Restrictions** @@ -29 +44,0 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 6. (Optional) In the **Instance configuration** section for **Use Fargate**Spot** capacity**, turn on **Enable using**Spot** instances**. @@ -31 +46 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 7. For **Maximum vCPUs** , enter the maximum number of vCPUs that the instance can use. +There are no country or regional restrictions associated with using this solution. @@ -33 +48 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 8. In the **Network configuration** section: +**Resource Usage Costs** @@ -35 +49,0 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 1. For **Virtual Private Cloud (VPC) ID** , choose an Amazon VPC. @@ -37 +51,18 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 2. For **Subnets** , the subnets for your AWS account are listed. If you want to create a custom set of subnets, choose **Clear subnets** , and then choose the subnets that you want. +There's no charge for creating an AWS account. However, by implementing this solution, you might incur some or all of the costs that are listed in the following table. + +Description | Cost (US dollars) +---|--- +Pricing is based on requested vCPU, memory, Operating Systems, CPU Architecture, and storage resources for the Task or Pod. | For more information about pricing, see [Fargate Pricing](https://aws.amazon.com/fargate/pricing/). + +## Prerequisites + +Before you begin: + + * Create an AWS account if you don't have one. + + * Create the task execution role. If you haven't already created the [Task Execution Role](./create-execution-role.html#create-execution-role.title) then you can create it as part of this tutorial. + + + + +## Step 1: Create a compute environment @@ -41 +72,11 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag -Compute resources must communicate with the Amazon ECS VPC endpoint through a VPC endpoint or multiple public IP address. For more information, see [Amazon ECS interface VPC endpoints ([AWS PrivateLink](./create-a-vpc.html))](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/vpc-endpoints.html). If your instance doesn't have a VPC endpoint configured or a public IP address, you can use network address translation (NAT). For more information about NAT, see [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) and [Create a virtual private cloud ](./create-public-private-vpc.html). +To get started as simply and quickly as possible, this tutorial includes steps with default settings. Before creating for production use, we recommend that you familiarize yourself with all settings and deploy with the settings that meet your requirements. + +To create a compute environment for a Fargate orchestration, do the following: + + 1. Open the [AWS Batch console first-run wizard](https://console.aws.amazon.com/batch/home#wizard). + + 2. For **Configure job and orchestration type** , choose **Fargate**. + + 3. Choose**Next**. + + 4. In the **Compute environment configuration** section for **Name** , specify a unique name for your compute environment. The name can be up to 128 characters in length. It can contain uppercase and lowercase letters, numbers, hyphens (-), and underscores (_). @@ -43 +84 @@ Compute resources must communicate with the Amazon ECS VPC endpoint through a VP - 3. For **Security groups** , choose the Amazon EC2 security groups that you want to associate with the instance. If you want to create a custom set of security groups, choose **Clear security groups**. Then, choose the security groups that you want. + 5. For all other configuration options you can leave the default value. @@ -45 +86 @@ Compute resources must communicate with the Amazon ECS VPC endpoint through a VP - 9. Choose **Next**. + 6. Choose **Next**. @@ -50 +91 @@ Compute resources must communicate with the Amazon ECS VPC endpoint through a VP -## Create a job queue +## Step 2: Create a job queue @@ -58,3 +99 @@ To create a job queue for a Fargate orchestration, do the following: - 2. For **Priority** , enter an integer between 0 and 100 for the job queue. - -###### Important + 2. For **Priority** , enter 900 for the job queue. @@ -62 +101 @@ To create a job queue for a Fargate orchestration, do the following: -Higher integer values are assigned a higher priority by the AWS Batch Scheduler. + 3. For all other configuration options you can leave the default value. @@ -64 +103 @@ Higher integer values are assigned a higher priority by the AWS Batch Scheduler. - 3. Choose **Next**. + 4. Choose **Next**. @@ -69 +108 @@ Higher integer values are assigned a higher priority by the AWS Batch Scheduler. -## Create a job definition +## Step 3: Create a job definition @@ -75 +114 @@ To create the job definition: - 1. For **Name** , enter a custom job definition name. + 1. In the **General configuration** section for **Name** , specify a unique name for your compute environment. The name can be up to 128 characters in length. It can contain uppercase and lowercase letters, numbers, hyphens (-), and underscores (_). @@ -77 +116 @@ To create the job definition: -In the **General configuration** section for **Name** , specify a unique name for your compute environment. The name can be up to 128 characters in length. It can contain uppercase and lowercase letters, numbers, hyphens (-), and underscores (_). + 2. In the **Fargate platform configuration** section: @@ -79 +118 @@ In the **General configuration** section for **Name** , specify a unique name fo - 2. (Optional) For **Execution timeout** , enter the amount of time (in seconds) that an unfinished job terminates after. + 1. Turn on **Assign public IP** to assign a public IP address. You need a public IP to download the container image unless you've setup a private image repository. @@ -81 +120 @@ In the **General configuration** section for **Name** , specify a unique name fo -###### Important + 2. For **Execution role** , choose a task execution role that lets Amazon Elastic Container Service (Amazon ECS) agents make AWS calls on your behalf. Choose either **ecsTaskExecutionRole** or **BatchEcsTaskExecutionRole**. @@ -83 +122 @@ In the **General configuration** section for **Name** , specify a unique name fo -The minimum timeout is 60 seconds. +To create the **Execution role** choose **Create an execution role**. In the **Create IAM role** modal choose **Create IAM role**. @@ -85 +124 @@ The minimum timeout is 60 seconds. - 3. (Optional) A tag is a label that's assigned to a resource. To add a tag, expand **Tags** , then choose **Add tag**. Enter a key-value pair, and then choose **Add tag** again. + 1. The IAM console has the permission setting already configured for creating the execution role. @@ -87 +126 @@ The minimum timeout is 60 seconds. -###### Important + 2. For **Trusted entity type** verify that **AWS service** is selected. @@ -89 +128 @@ The minimum timeout is 60 seconds. -If you choose **Add tag** , you must enter a key-value pair and choose **Add tag** again or choose **Remove tag**. + 3. For **Service or user case** verify that **Elastic Container Service** is selected. @@ -91 +130 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 4. (Optional) Turn on **Propagate tags** to propagate tags to the Amazon Elastic Container Service task. + 4. Choose **Next**. @@ -93 +132 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 2. In the **Fargate platform configuration** section: + 5. For **Permissions policies** verify that **AmazonECSTaskExecutionRolePolicy** is selected. @@ -95 +134 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 1. (Optional) For **Fargate platform version** , enter the specific runtime environment that you want. + 6. Choose **Next**. @@ -97 +136 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 2. For **Runtime platform** , select a **LINUX** or **Windows**. + 7. For **Name, review, and create** verify that the role name is **BatchEcsTaskExecutionRole**. @@ -99 +138 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 3. (Windows only) For **Operating System Family** , select an operating system. + 8. Choose **Create role**. @@ -101 +140 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 4. For **CPU architecture** , select the CPU architecture that you want. + 9. In the AWS Batch console choose the refresh button next to **Execution role**. Choose the **BatchEcsTaskExecutionRole** execution role. @@ -103 +142 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 5. (Optional) Turn on **Assign public IP** to assign a public IP address. + 3. In the **Container configuration** section: @@ -105 +144 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag - 6. For **Ephemeral storage** , enter the amount of ephemeral storage that you want. + 1. For **Command** , you can change `hello world` to a custom message or leave it as is. @@ -107 +146 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag -###### Note + 4. For all other configuration options you can leave the default value. @@ -109 +148 @@ If you choose **Add tag** , you must enter a key-value pair and choose **Add tag -By default, 20 GiB of ephemeral storage is used. To use additional ephemeral storage, enter a value between 21 GiB and 100 GiB. + 5. Choose **Next**. @@ -111 +149,0 @@ By default, 20 GiB of ephemeral storage is used. To use additional ephemeral sto - 7. For **Execution role** , choose a task execution role that lets Amazon Elastic Container Service (Amazon ECS) agents make AWS calls on your behalf. For example, you can choose **ecsTaskExecutionRole**. @@ -113 +150,0 @@ By default, 20 GiB of ephemeral storage is used. To use additional ephemeral sto - 3. In the **Container configuration** section: @@ -115 +151,0 @@ By default, 20 GiB of ephemeral storage is used. To use additional ephemeral sto - 1. For **Image** , enter the name of the image that's used to launch the container. By default, all the images in the Docker Hub registry are available. You can also specify other repositories in _repository-url/image:tag_ format. The parameter can be up to 255 characters in length. It can contain uppercase and lowercase letters, numbers, hyphens (-), underscores (_), colons (:), periods (.), forward slashes (/), and number signs (#). The parameter maps to `Image` in the [Create a container](https://docs.docker.com/engine/api/v1.38/#operation/ContainerCreate) section of the [Docker Remote API](https://docs.docker.com/engine/api/v1.38/) and the `IMAGE` parameter of [**docker run**](https://docs.docker.com/engine/reference/commandline/run/). @@ -117 +153 @@ By default, 20 GiB of ephemeral storage is used. To use additional ephemeral sto -###### Note +## Step 4: Create a job @@ -119 +155 @@ By default, 20 GiB of ephemeral storage is used. To use additional ephemeral sto -Docker image architecture must match the processor architecture of the compute resources that they're scheduled on. For example, Arm based Docker images can only run on Arm based compute resources. +To create a Fargate job, do the following: @@ -121 +157 @@ Docker image architecture must match the processor architecture of the compute r - * Images in Amazon ECR Public repositories use the full `registry/repository[:tag]` or `registry/repository[@digest]` naming conventions (for example, `public.ecr.aws/`registry_alias`/`my-web-app`:`latest``). + 1. In the **Job configuration** section for **Name** , specify a unique name for the job. The name can be up to 128 characters in length. It can contain uppercase and lowercase letters, numbers, hyphens (-), and underscores (_). @@ -123 +159 @@ Docker image architecture must match the processor architecture of the compute r - * Images in Amazon ECR repositories use the full `registry/repository:tag` naming convention (for example, ``aws_account_id`.dkr.ecr.`region`.amazonaws.com``/`my-web-app`:`latest``). + 2. For all other configuration options you can leave the default value. @@ -125 +161 @@ Docker image architecture must match the processor architecture of the compute r - * Images in official repositories on Docker Hub use a single name (for example, `ubuntu` or `mongo`). + 3. Choose**Next**. @@ -127 +162,0 @@ Docker image architecture must match the processor architecture of the compute r - * Images in other repositories on Docker Hub are qualified with an organization name (for example, `amazon/amazon-ecs-agent`). @@ -129 +163,0 @@ Docker image architecture must match the processor architecture of the compute r - * Images in other online repositories are qualified further by a domain name (for example, `quay.io/assemblyline/ubuntu`). @@ -131 +164,0 @@ Docker image architecture must match the processor architecture of the compute r - 2. For **Command** , enter the commands into the field as their **JSON** string array equivalent.