AWS pcs documentation change
Summary
Updated troubleshooting guidance for compute node registration failures, including new error examples and clearer permission verification instructions.
Security assessment
The changes improve operational documentation by adding specific error examples and clarifying IAM permission requirements. While IAM permissions are security-relevant, this update doesn't address a specific vulnerability or weakness, but rather enhances existing troubleshooting content.
Diff
diff --git a/pcs/latest/userguide/troubleshooting-compute-node-bootstrap.md b/pcs/latest/userguide/troubleshooting-compute-node-bootstrap.md index c22348b40..906aaa7b0 100644 --- a//pcs/latest/userguide/troubleshooting-compute-node-bootstrap.md +++ b//pcs/latest/userguide/troubleshooting-compute-node-bootstrap.md @@ -166,9 +166,8 @@ Node registration is the first action executed by a compute node during bootstra - <13>Nov 5 08:10:27 user-data: Recipe: aws-pcs-environment::node_registration - <13>Nov 5 08:10:27 user-data: * ruby_block[Register NodeGroup Instance] action run[2024-11-05T08:10:27+00:00] INFO: Processing ruby_block[Register NodeGroup Instance] action run (aws-pcs-environment::node_registration line 19) - <13>Nov 5 08:15:46 user-data: - <13>Nov 5 08:15:46 user-data: - <13>Nov 5 08:15:46 user-data: ================================================================================ - <13>Nov 5 08:15:46 user-data: Error executing action `run` on resource 'ruby_block[Register NodeGroup Instance]' - <13>Nov 5 08:15:46 user-data: ================================================================================ - <13>Nov 5 08:15:46 user-data: - <13>Nov 5 08:15:46 user-data: EOFError + <13>Nov 13 16:23:50 user-data: [2025-11-13T16:23:50.510+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Registering node to cluster <clusterId> + <13>Nov 13 16:24:18 user-data: [2025-11-13T16:24:18.192+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Retriable exception detected. + <13>Nov 13 16:24:18 user-data: [2025-11-13T16:24:18.193+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Response is [specific error message] + <13>Nov 13 16:24:18 user-data: [2025-11-13T16:24:18.194+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Retrying in 31 seconds... + <13>Nov 13 16:24:18 user-data: [2025-11-13T16:24:18.192+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Retriable exception detected. + ... + <13>Nov 13 16:25:18 user-data: [2025-11-13T16:25:18.195+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Registration timeout (600 seconds) reached. Exiting. + <13>Nov 13 16:25:18 user-data: [2025-11-13T16:25:18.200+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: ERROR: Error: (2) occurred on line 1 when running /opt/aws/pcs/bin/pcs_bootstrap_init.sh. Shutting down instance. @@ -178 +177,8 @@ Node registration is the first action executed by a compute node during bootstra -If the instance is unable to register, verify that the instance profile associated with the compute node has the `pcs:RegisterComputeNodeGroupInstance` permission. +If the node is unable to register due to a wrong instance profile you will see the following error: + + + <13>Nov 13 18:43:08 user-data: [2025-11-13T18:43:08.268+00:00] - /opt/aws/pcs/bin/pcs_bootstrap_init.sh: INFO: Response is { + <13>Nov 13 18:43:08 user-data: "__type": "com.amazon.coral.service#AccessDeniedException", + <13>Nov 13 18:43:08 user-data: "Message": "User: arn:aws:sts::<accountId>:assumed-role/<roleName>/<instanceId> is not authorized to perform: pcs:RegisterComputeNodeGroupInstance on resource: arn:aws:pcs:<regionCode>:<accountId>:cluster/<clusterId> as either the resource does not exist, some policy explicitly denies access, or no policy grants access", + <13>Nov 13 18:43:08 user-data: "nodeID": null + <13>Nov 13 18:43:08 user-data: } @@ -180 +186 @@ If the instance is unable to register, verify that the instance profile associat -For more information about how to create a valid instance profile, see [Create an instance profile for AWS PCS](./getting-started_create-cng_instance-profile.html). +Verify that the instance profile associated with the compute node has the `pcs:RegisterComputeNodeGroupInstance` permission. For more information about how to create a valid instance profile, see [Create an instance profile for AWS PCS](./getting-started_create-cng_instance-profile.html). @@ -202 +208 @@ If you see an error message similar to the following, verify the policy associat - com.amazon.coral.security.AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/rolename/i-instanceid is not authorized to perform: pcs:RegisterComputeNodeGroupInstance on resource: arn:aws:pcs:us-west-2:xxx:cluster/cluster-id as either the resource does not exist, some policy explicitly denies access, or no policy grants access + com.amazon.coral.security.AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/<roleName>/<instanceId> is not authorized to perform: pcs:RegisterComputeNodeGroupInstance on resource: arn:aws:pcs:<regionCode>:<accountId>:cluster/<clusterId> as either the resource does not exist, some policy explicitly denies access, or no policy grants access @@ -312 +318 @@ EC2 instance is terminated and replaced after reboot -Document history +Job submission MaxJobCount limit