AWS deadline-cloud documentation change
Summary
Updated license endpoint documentation to emphasize AWS console workflow over CLI, added Step 4 for endpoint deletion, restructured requirements (removed explicit IAM role mention but kept policy reference), and clarified PrivateLink billing
Security assessment
Changes focus on workflow modernization (console vs CLI) and cost awareness rather than security fixes. While security groups and IAM policies are mentioned, these are existing security controls rather than new mitigations. The IAM role requirement removal from the initial list is offset by maintained policy references elsewhere. No evidence of addressing vulnerabilities or exploits.
Diff
diff --git a/deadline-cloud/latest/developerguide/cmf-ubl.md b/deadline-cloud/latest/developerguide/cmf-ubl.md index d73c314b8..ab8c3bf4f 100644 --- a//deadline-cloud/latest/developerguide/cmf-ubl.md +++ b//deadline-cloud/latest/developerguide/cmf-ubl.md @@ -5 +5 @@ -Step 1: Create a security groupStep 2: Set up the license endpointStep 3: Connect a rendering application to an endpoint +Step 1: Create a security groupStep 2: Set up the license endpointStep 3: Connect a rendering application to an endpointStep 4: Delete a license endpoint @@ -13,8 +13 @@ The Deadline Cloud usage-based license server can be used with any fleet type as -To create the license server, you need the following: - - * A security group for your farm's VPC that allows traffic for third-party licenses. - - * An AWS Identity and Access Management (IAM) role with an attached policy that allows access to the Deadline Cloud license endpoint operations. - - - +To create the license server, you need a security group for your farm's VPC that allows traffic for third-party licenses. @@ -29,0 +23,2 @@ To create the license server, you need the following: + * Step 4: Delete a license endpoint + @@ -60,14 +55 @@ For more information about creating a security group, see [ Create a security gr -A _license endpoint_ provides access to license servers for third-party products. License requests are sent to the license endpoint. The endpoint routes them to the appropriate license server. The license server tracks usage limits and entitlements. There is a charge for each license endpoint that you create. For more information, see [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing). - -You can create your license endpoint from the AWS Command Line Interface with the appropriate permissions. For the required policy to create a license endpoint, see [ Policy to allow creating a license endpoint ](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/security_iam_id-based-policy-examples.html#security_iam-id-based-policy-examples-create-endpoint). - -You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or any other AWS CLI environment to configure the license endpoint using the following AWS Command Line Interface commands. - - 1. Create the license endpoint. Replace the security group ID, subnet ID, and VPC ID with the values you created earlier. If you use multiple subnets, separate them with spaces. - - aws deadline create-license-endpoint \ - --security-group-id SECURITY_GROUP_ID \ - --subnet-ids SUBNET_ID1 SUBNET_ID2 \ - --vpc-id VPC_ID - - 2. Confirm that the endpoint was created successfully with the following command. Remember the DNS name of the VPC endpoint. +A _license endpoint_ provides access to license servers for third-party products. License requests are sent to the license endpoint. The endpoint routes them to the appropriate license server. The license server tracks usage limits and entitlements. Creating a license endpoint in Deadline Cloud provisions an AWS PrivateLink interface endpoint in your VPC. These endpoints are billed according to standard AWS PrivateLink pricing. For more information, see [AWS PrivateLink pricing](https://aws.amazon.com/privatelink/pricing). @@ -75,2 +57 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a - aws deadline get-license-endpoint \ - --license-endpoint-id LICENSE_ENDPOINT_ID +With the appropriate permissions, you can create your license endpoint. For the required policy to create a license endpoint, see [Policy to allow creating a license endpoint](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/security_iam_id-based-policy-examples.html#security_iam-id-based-policy-examples-create-endpoint). @@ -78 +59 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a - 3. View a list of available metered products: +You can create your license endpoint from your dashboard in the Deadline Cloud [console](https://console.aws.amazon.com/deadlinecloud/home). @@ -80 +61 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a - aws deadline list-available-metered-products + 1. From the left navigation pane, choose **License endpoints** , then choose **Create license endpoint**. @@ -82 +63 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a - 4. Add metered products to the license endpoint with the following command. + 2. From the Create license endpoint page, complete the following: @@ -84,3 +65 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a - aws deadline put-metered-product \ - --license-endpoint-id LICENSE_ENDPOINT_ID \ - --product-id PRODUCT_ID + * Select a VPC. @@ -87,0 +67 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a + * Select the subnets that contain your Deadline Cloud workers. You can select up to 10 subnets. @@ -88,0 +69 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a + * Select the security group you created in step 1. You can select up to 10 security groups for more complicated scenarios. @@ -89,0 +71 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a + * (Optional) Choose **Add new tag** and add one or more tags. You can add up to 50 tags. @@ -91 +73 @@ You can use the [AWS CloudShell](https://console.aws.amazon.com/cloudshell) or a -You can remove a product from a license endpoint with the `remove-metered-product` command: + 3. Choose **Create license endpoint**. When the license endpoint creates, it displays on the license endpoints page. @@ -92,0 +75 @@ You can remove a product from a license endpoint with the `remove-metered-produc + 4. From the metered products section, choose **Add products** , and then select the products you want to add to your license endpoint. Choose **Add**. @@ -94,3 +76,0 @@ You can remove a product from a license endpoint with the `remove-metered-produc - aws deadline remove-metered-product \ - --license-endpoint-id LICENSE_ENDPOINT_ID \ - --product-id PRODUCT_ID @@ -98 +77,0 @@ You can remove a product from a license endpoint with the `remove-metered-produc -You can delete a license endpoint with the `delete-license-endpoint` command: @@ -101,2 +80 @@ You can delete a license endpoint with the `delete-license-endpoint` command: - aws deadline delete-license-endpoint \ - --license-endpoint-id LICENSE_ENDPOINT_ID +To remove a product from a license endpoint, in the metered products section, select the product and then choose **Remove**. In the confirmation, choose **Remove** again. @@ -108,6 +86 @@ After the license endpoint is set up, applications use it the same as they use a -To get the license endpoint DNS name, use the following AWS CLI command. - - - aws deadline get-license-endpoint --license-endpoint-id LICENSE_ENDPOINT_ID - -Or you can use the [Amazon VPC Console](https://console.aws.amazon.com/vpc) to identify the VPC endpoint created by the Deadline Cloud API in the previous step. +To get the license endpoint DNS name, select the license endpoint in the console and then choose the copy icon in the DNS Name section. @@ -206,0 +180,13 @@ To test that licensing is working properly, you can render a Houdini scene via t +## Step 4: Delete a license endpoint + +When deleting your customer-managed fleet, remember to delete your license endpoint. If you don't delete the license endpoint, you will continue to be charged for AWS PrivateLink fixed costs + +You can delete your license endpoint from your dashboard in the Deadline Cloud [console](https://console.aws.amazon.com/deadlinecloud/home). + + 1. From the left navigation pane, choose **License endpoints**. + + 2. Select the endpoint you want to delete and choose **delete** , then choose **delete** again to confirm. + + + +