AWS parallelcluster medium security documentation change

Service: parallelcluster · 2025-05-31 · Security-related medium

File: parallelcluster/latest/ug/aws-parallelcluster-in-a-single-public-subnet-no-internet-v3.md

Summary

Added VPC endpoint requirements for Elastic Load Balancing and Auto Scaling when LoginNodes are enabled, with configuration examples

Security assessment

Added requirements for VPC endpoints and security groups to control network traffic between cluster components. This change documents security-related network isolation measures for LoginNodes functionality.

Diff

diff --git a/parallelcluster/latest/ug/aws-parallelcluster-in-a-single-public-subnet-no-internet-v3.md b/parallelcluster/latest/ug/aws-parallelcluster-in-a-single-public-subnet-no-internet-v3.md
index e132b51fd..cdf9be840 100644
--- a//parallelcluster/latest/ug/aws-parallelcluster-in-a-single-public-subnet-no-internet-v3.md
+++ b//parallelcluster/latest/ug/aws-parallelcluster-in-a-single-public-subnet-no-internet-v3.md
@@ -29,0 +30,2 @@ AWS Secrets Manager** |  com.amazonaws.`region-id`.secretsmanager |  Interface
+AWS Elastic Load Balancing*** |  com.amazonaws.`region-id`.elasticloadbalancing |  Interface  
+AWS Auto Scaling*** |  com.amazonaws.`region-id`.autoscaling |  Interface  
@@ -41,0 +44,2 @@ AWS Secrets Manager** |  com.amazonaws.`region-id`.secretsmanager |  Interface
+AWS Elastic Load Balancing*** |  com.amazonaws.`region-id`.elasticloadbalancing |  Interface  
+AWS Auto Scaling*** |  cn.com.amazonaws.`region-id`.autoscaling |  Interface  
@@ -44,0 +49,2 @@ AWS Secrets Manager** |  com.amazonaws.`region-id`.secretsmanager |  Interface
+*** These endpoints are only required when [LoginNodes](./LoginNodes-v3.html) is enabled, otherwise they are optional.
+
@@ -110,0 +117,8 @@ The configuration for this architecture requires the following settings:
+    LoginNodes: # optional, if enabled, requires creation and configuration of VPC endpoints for AWS Elastic Load Balancing (ELB) and Auto Scaling services
+      Pools:
+        - ...
+          Networking:
+            SubnetIds:
+              - subnet-1234567890abcdef0 # the VPC of the subnet needs to have VPC endpoints attached
+            AdditionalSecurityGroups:
+              - sg-1abcdef01234567890 # optional, the security group that enables the communication between the cluster and the VPC endpoints