AWS parallelcluster documentation change
Summary
Updated multiple ARNs across IAM policies to use concrete region (us-east-1) and account ID (111122223333)
Security assessment
Consistent updates to resource ARN patterns for documentation accuracy. Changes improve policy examples but don't introduce new security controls.
Diff
diff --git a/parallelcluster/v2/ug/iam.md b/parallelcluster/v2/ug/iam.md index 817a60394..1cf826535 100644 --- a//parallelcluster/v2/ug/iam.md +++ b//parallelcluster/v2/ug/iam.md @@ -114,9 +114,9 @@ JSON - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:subnet/<COMPUTE SUBNET ID>", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:network-interface/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:instance/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:volume/*", - "arn:aws:ec2:<REGION>::image/<IMAGE ID>", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:key-pair/<KEY NAME>", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:security-group/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:launch-template/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:placement-group/*" + "arn:aws:ec2:us-east-1:111122223333:subnet/<COMPUTE SUBNET ID>", + "arn:aws:ec2:us-east-1:111122223333:network-interface/*", + "arn:aws:ec2:us-east-1:111122223333:instance/*", + "arn:aws:ec2:us-east-1:111122223333:volume/*", + "arn:aws:ec2:us-east-1::image/<IMAGE ID>", + "arn:aws:ec2:us-east-1:111122223333:key-pair/<KEY NAME>", + "arn:aws:ec2:us-east-1:111122223333:security-group/*", + "arn:aws:ec2:us-east-1:111122223333:launch-template/*", + "arn:aws:ec2:us-east-1:111122223333:placement-group/*" @@ -144 +144 @@ JSON - "arn:aws:cloudformation:<REGION>:<AWS ACCOUNT ID>:stack/parallelcluster-*/*" + "arn:aws:cloudformation:us-east-1:111122223333:stack/parallelcluster-*/*" @@ -159 +159 @@ JSON - "arn:aws:dynamodb:<REGION>:<AWS ACCOUNT ID>:table/parallelcluster-*" + "arn:aws:dynamodb:us-east-1:111122223333:table/parallelcluster-*" @@ -169 +169 @@ JSON - "arn:aws:s3:::<REGION>-aws-parallelcluster/*" + "arn:aws:s3:::us-east-1-aws-parallelcluster/*" @@ -196 +196 @@ JSON - "arn:aws:s3:::dcv-license.<REGION>/*" + "arn:aws:s3:::dcv-license.us-east-1/*" @@ -287,9 +287,9 @@ JSON - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:subnet/<COMPUTE SUBNET ID>", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:network-interface/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:instance/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:volume/*", - "arn:aws:ec2:<REGION>::image/<IMAGE ID>", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:key-pair/<KEY NAME>", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:security-group/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:launch-template/*", - "arn:aws:ec2:<REGION>:<AWS ACCOUNT ID>:placement-group/*" + "arn:aws:ec2:us-east-1:111122223333:subnet/<COMPUTE SUBNET ID>", + "arn:aws:ec2:us-east-1:111122223333:network-interface/*", + "arn:aws:ec2:us-east-1:111122223333:instance/*", + "arn:aws:ec2:us-east-1:111122223333:volume/*", + "arn:aws:ec2:us-east-1::image/<IMAGE ID>", + "arn:aws:ec2:us-east-1:111122223333:key-pair/<KEY NAME>", + "arn:aws:ec2:us-east-1:111122223333:security-group/*", + "arn:aws:ec2:us-east-1:111122223333:launch-template/*", + "arn:aws:ec2:us-east-1:111122223333:placement-group/*" @@ -319 +319 @@ JSON - "arn:aws:sqs:<REGION>:<AWS ACCOUNT ID>:parallelcluster-*" + "arn:aws:sqs:us-east-1:111122223333:parallelcluster-*" @@ -346 +346 @@ JSON - "arn:aws:cloudformation:<REGION>:<AWS ACCOUNT ID>:stack/parallelcluster-*/*" + "arn:aws:cloudformation:us-east-1:111122223333:stack/parallelcluster-*/*" @@ -361 +361 @@ JSON - "arn:aws:dynamodb:<REGION>:<AWS ACCOUNT ID>:table/parallelcluster-*" + "arn:aws:dynamodb:us-east-1:111122223333:table/parallelcluster-*" @@ -371 +371 @@ JSON - "arn:aws:s3:::<REGION>-aws-parallelcluster/*" + "arn:aws:s3:::us-east-1-aws-parallelcluster/*" @@ -408 +408 @@ JSON - "arn:aws:s3:::dcv-license.<REGION>/*" + "arn:aws:s3:::dcv-license.us-east-1/*" @@ -496,9 +496,9 @@ JSON - "arn:aws:batch:<REGION>:<AWS ACCOUNT ID>:job-definition/<AWS_BATCH_STACK - JOB_DEFINITION_SERIAL_NAME>:1", - "arn:aws:batch:<REGION>:<AWS ACCOUNT ID>:job-definition/<AWS_BATCH_STACK - JOB_DEFINITION_MNP_NAME>*", - "arn:aws:batch:<REGION>:<AWS ACCOUNT ID>:job-queue/<AWS_BATCH_STACK - JOB_QUEUE_NAME>", - "arn:aws:cloudformation:<REGION>:<AWS ACCOUNT ID>:stack/<STACK NAME>/*", - "arn:aws:s3:::<RESOURCES S3 BUCKET>/batch/*", - "arn:aws:iam::<AWS ACCOUNT ID>:role/<AWS_BATCH_STACK - JOB_ROLE>", - "arn:aws:ecs:<REGION>:<AWS ACCOUNT ID>:cluster/<ECS COMPUTE ENVIRONMENT>", - "arn:aws:ecs:<REGION>:<AWS ACCOUNT ID>:container-instance/*", - "arn:aws:logs:<REGION>:<AWS ACCOUNT ID>:log-group:/aws/batch/job:log-stream:*" + "arn:aws:batch:us-east-1:111122223333:job-definition/<AWS_BATCH_STACK - JOB_DEFINITION_SERIAL_NAME>:1", + "arn:aws:batch:us-east-1:111122223333:job-definition/<AWS_BATCH_STACK - JOB_DEFINITION_MNP_NAME>*", + "arn:aws:batch:us-east-1:111122223333:job-queue/<AWS_BATCH_STACK - JOB_QUEUE_NAME>", + "arn:aws:cloudformation:us-east-1:111122223333:stack/<STACK NAME>/*", + "arn:aws:s3:::amzn-s3-demo-bucket/batch/*", + "arn:aws:iam::111122223333:role/<AWS_BATCH_STACK - JOB_ROLE>", + "arn:aws:ecs:us-east-1:111122223333:cluster/<ECS COMPUTE ENVIRONMENT>", + "arn:aws:ecs:us-east-1:111122223333:container-instance/*", + "arn:aws:logs:us-east-1:111122223333:log-group:/aws/batch/job:log-stream:*" @@ -513 +513 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -753 +753 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -764 +764 @@ JSON - "arn:aws:s3:::<REGION>-aws-parallelcluster*" + "arn:aws:s3:::us-east-1-aws-parallelcluster*" @@ -776 +776 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -791,2 +791,2 @@ JSON - "arn:aws:iam::<AWS ACCOUNT ID>:role/<PARALLELCLUSTER EC2 ROLE NAME>", - "arn:aws:iam::<AWS ACCOUNT ID>:role/parallelcluster-*" + "arn:aws:iam::111122223333:role/<PARALLELCLUSTER EC2 ROLE NAME>", + "arn:aws:iam::111122223333:role/parallelcluster-*" @@ -809 +809 @@ JSON - "Resource": "arn:aws:iam::<AWS ACCOUNT ID>:role/aws-service-role/*", + "Resource": "arn:aws:iam::111122223333:role/aws-service-role/*", @@ -818 +818 @@ JSON - "Resource": "arn:aws:iam::<AWS ACCOUNT ID>:instance-profile/*", + "Resource": "arn:aws:iam::111122223333:instance-profile/*", @@ -898,2 +898,2 @@ JSON - "arn:aws:lambda:<REGION>:<AWS ACCOUNT ID>:function:parallelcluster-*", - "arn:aws:lambda:<REGION>:<AWS ACCOUNT ID>:function:pcluster-*" + "arn:aws:lambda:us-east-1:111122223333:function:parallelcluster-*", + "arn:aws:lambda:us-east-1:111122223333:function:pcluster-*" @@ -1140 +1140 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -1151 +1151 @@ JSON - "arn:aws:s3:::<REGION>-aws-parallelcluster*" + "arn:aws:s3:::us-east-1-aws-parallelcluster*" @@ -1163 +1163 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -1178,2 +1178,2 @@ JSON - "arn:aws:iam::<AWS ACCOUNT ID>:role/<PARALLELCLUSTER EC2 ROLE NAME>", - "arn:aws:iam::<AWS ACCOUNT ID>:role/parallelcluster-*" + "arn:aws:iam::111122223333:role/<PARALLELCLUSTER EC2 ROLE NAME>", + "arn:aws:iam::111122223333:role/parallelcluster-*" @@ -1196 +1196 @@ JSON - "Resource": "arn:aws:iam::<AWS ACCOUNT ID>:role/aws-service-role/*", + "Resource": "arn:aws:iam::111122223333:role/aws-service-role/*", @@ -1205 +1205 @@ JSON - "Resource": "arn:aws:iam::<AWS ACCOUNT ID>:instance-profile/*", + "Resource": "arn:aws:iam::111122223333:instance-profile/*", @@ -1285,2 +1285,2 @@ JSON - "arn:aws:lambda:<REGION>:<AWS ACCOUNT ID>:function:parallelcluster-*", - "arn:aws:lambda:<REGION>:<AWS ACCOUNT ID>:function:pcluster-*" + "arn:aws:lambda:us-east-1:111122223333:function:parallelcluster-*", + "arn:aws:lambda:us-east-1:111122223333:function:pcluster-*" @@ -1416 +1416 @@ JSON - "Resource": "arn:aws:dynamodb:<REGION>:<AWS ACCOUNT ID>:table/parallelcluster-*", + "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/parallelcluster-*", @@ -1432 +1432 @@ JSON - "Resource": "arn:aws:cloudformation:<REGION>:<AWS ACCOUNT ID>:stack/parallelcluster-*", + "Resource": "arn:aws:cloudformation:us-east-1:111122223333:stack/parallelcluster-*", @@ -1470 +1470 @@ JSON - "Resource": "arn:aws:sqs:<REGION>:<AWS ACCOUNT ID>:parallelcluster-*", + "Resource": "arn:aws:sqs:us-east-1:111122223333:parallelcluster-*", @@ -1497,2 +1497,2 @@ JSON - "arn:aws:iam::<AWS ACCOUNT ID>:role/parallelcluster-*", - "arn:aws:iam::<AWS ACCOUNT ID>:role/<PARALLELCLUSTER EC2 ROLE NAME>" + "arn:aws:iam::111122223333:role/parallelcluster-*", + "arn:aws:iam::111122223333:role/<PARALLELCLUSTER EC2 ROLE NAME>" @@ -1510 +1510 @@ JSON - "Resource": "arn:aws:iam::<AWS ACCOUNT ID>:instance-profile/*", + "Resource": "arn:aws:iam::111122223333:instance-profile/*", @@ -1534 +1534 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -1545 +1545 @@ JSON - "arn:aws:s3:::<REGION>-aws-parallelcluster/*" + "arn:aws:s3:::us-east-1-aws-parallelcluster/*" @@ -1557 +1557 @@ JSON - "arn:aws:s3:::<RESOURCES S3 BUCKET>" + "arn:aws:s3:::amzn-s3-demo-bucket" @@ -1576,2 +1576,2 @@ JSON - "arn:aws:lambda:<REGION>:<AWS ACCOUNT ID>:function:parallelcluster-*", - "arn:aws:lambda:<REGION>:<AWS ACCOUNT ID>:function:pcluster-*" + "arn:aws:lambda:us-east-1:111122223333:function:parallelcluster-*", + "arn:aws:lambda:us-east-1:111122223333:function:pcluster-*" @@ -1586 +1586 @@ JSON - "Resource": "arn:aws:logs:<REGION>:<AWS ACCOUNT ID>:*", + "Resource": "arn:aws:logs:us-east-1:111122223333:*", @@ -1594 +1594 @@ JSON - "Resource": "arn:aws:codebuild:<REGION>:<AWS ACCOUNT ID>:project/parallelcluster-*", + "Resource": "arn:aws:codebuild:us-east-1:111122223333:project/parallelcluster-*", @@ -1729 +1729 @@ JSON - "Resource": "arn:aws:dynamodb:<REGION>:<AWS ACCOUNT ID>:table/parallelcluster-*", + "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/parallelcluster-*", @@ -1851,4 +1851,4 @@ JSON - "arn:aws:autoscaling:<REGION>:<AWS ACCOUNT ID>:autoScalingGroup:*:autoScalingGroupName/parallelcluster-*", - "arn:aws:batch:<REGION>:<AWS ACCOUNT ID>:compute-environment/*", - "arn:aws:cloudformation:<REGION>:<AWS ACCOUNT ID>:stack/<CLUSTERNAME>/*", - "arn:aws:dynamodb:<REGION>:<AWS ACCOUNT ID>:table/<CLUSTERNAME>" + "arn:aws:autoscaling:us-east-1:111122223333:autoScalingGroup:*:autoScalingGroupName/parallelcluster-*", + "arn:aws:batch:us-east-1:111122223333:compute-environment/*", + "arn:aws:cloudformation:us-east-1:111122223333:stack/<CLUSTERNAME>/*", + "arn:aws:dynamodb:us-east-1:111122223333:table/<CLUSTERNAME>"