AWS deadline-cloud documentation change
Summary
Restructured documentation about configuring conda channels, removed step-by-step queue creation instructions, added references to automated package building processes, and consolidated channel hosting information.
Security assessment
The changes focus on workflow improvements and documentation restructuring rather than addressing security vulnerabilities. While there are references to IAM permissions for S3 bucket access, these are standard security controls mentioned in existing documentation rather than new security content. No evidence of patching vulnerabilities or addressing security incidents.
Diff
diff --git a/deadline-cloud/latest/developerguide/configure-jobs-s3-channel.md b/deadline-cloud/latest/developerguide/configure-jobs-s3-channel.md index 017133eb9..8acb992b5 100644 --- a//deadline-cloud/latest/developerguide/configure-jobs-s3-channel.md +++ b//deadline-cloud/latest/developerguide/configure-jobs-s3-channel.md @@ -5 +5 @@ -Create a package building queueConfigure production queue permissions for custom conda packagesAdd a conda channel to a queue environment +Configure production queue permissions for custom conda packagesAdd a conda channel to a queue environment @@ -9 +9 @@ Create a package building queueConfigure production queue permissions for custom -If you have custom packages for applications that are not available on the `deadline-cloud` or `conda-forge` channels you can create a conda channel that contains the packages that your environments use. You can store the packages in an Amazon S3 bucket and use AWS Identity and Access Management permissions to control access to the channel. +If your jobs need to run applications not available on the [`deadline-cloud`](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/create-queue-environment.html#conda-queue-environment) or [`conda-forge`](https://conda-forge.org/) channels, you can host a custom conda channel to serve your own packages. When you create a queue in the AWS Deadline Cloud (Deadline Cloud) console, the console adds a conda queue environment by default. To enable your custom channel, add it to the channel list in the queue environment. @@ -11 +11 @@ If you have custom packages for applications that are not available on the `dead -You can use a Deadline Cloud queue to build the packages for your conda channel to make it easier to update and maintain the application packages. +A conda channel is static hosted content that you can host in [a variety of ways](https://rattler-build.prefix.dev/latest/publish/), including on a filesystem or in an Amazon Simple Storage Service (Amazon S3) bucket. If your Deadline Cloud farm uses a shared filesystem for assets, you can use any path on it as a channel name. You can host the channel in an Amazon S3 bucket for broader access using AWS Identity and Access Management (IAM) permissions. @@ -13 +13 @@ You can use a Deadline Cloud queue to build the packages for your conda channel -A key benefit of this approach is that your package building queue can create packages for multiple different operating systems, and with or without CUDA support. By comparison, if you build packages on your workstation, you need to create and manage different workstations for these cases. +You can [build and test packages locally](./build-test-packages-locally.html), then [publish them to a channel](./publish-packages-s3-channel.html). Building packages locally is an easy way to start iterating on package build recipes with no infrastructure setup. You can also use a Deadline Cloud [package building queue](./automate-package-builds.html) to build packages and publish them to a channel. A package building queue simplifies maintaining packages for multiple operating systems and accelerator configurations. You can update versions and submit full sets of package builds from anywhere. @@ -15,3 +15 @@ A key benefit of this approach is that your package building queue can create pa -The following examples show how to create a conda channel that provides and application for your environments. The application in the examples is Blender 4.2, but any of the Deadline Cloud integrated applications can be used. - -You can use an AWS CloudFormation template to create a Deadline Cloud farm that includes a package building queue, or you can follow the instructions below to create the example farm yourself. For the CloudFormation template, see [A starter AWS Deadline Cloud farm](https://github.com/aws-deadline/deadline-cloud-samples/tree/mainline/cloudformation/farm_templates/starter_farm) in the Deadline Cloud samples repository on GitHub. +You can configure channels for your studio and your Deadline Cloud farm in multiple ways. You can have one Amazon S3 channel and configure all your workstations and farm hosts to use it. You can also have more than one channel and set up mirroring with AWS DataSync (DataSync). For example, your Deadline Cloud package building queue can publish to an Amazon S3 channel that gets mirrored on premises for workstations and on-premises farm hosts. @@ -25,2 +22,0 @@ You can use an AWS CloudFormation template to create a Deadline Cloud farm that - * Create a package building queue - @@ -39,66 +35 @@ You can use an AWS CloudFormation template to create a Deadline Cloud farm that - - - -## Create a package building queue - -In this example you create a Deadline Cloud queue to build the Blender 4.2 application. This simplifies delivery of the finished packages to the Amazon S3 bucket used as the conda channel and lets you use your existing fleet to build the package. This reduces the number of infrastructure components to manage. - -Follow the instructions in [Create a queue](https://docs.aws.amazon.com/deadline-cloud/latest/userguide/create-queue.html) in the _Deadline Cloud User Guide_. Make the following changes: - - * In step 5, choose an existing S3 bucket. Specify a root folder name such as `DeadlineCloudPackageBuild` so that build artifacts stay separate from your normal Deadline Cloud attachments. - - * In step 6, you can associate the package building queue with an existing fleet, or you can create an entirely new fleet if your current fleet is unsuitable. - - * In step 9, create a new service role for your package building queue. You will modify the permissions to give the queue the permissions required for uploading packages and reindexing a conda channel. - - - - -### Configure the package building queue permissions - -To allow the package build queue to access the `/Conda` prefix in the queue's S3 bucket, you must modify the queue's role to give it read/write access. The role needs the following permissions so that package build jobs can upload new packages and reindex the channel. - - * `s3:GetObject` - - * `s3:PutObject` - - * `s3:ListBucket` - - * `s3:GetBucketLocation` - - * `s3:DeleteObject` - - - - - 1. Open the Deadline Cloud console and navigate to the queue details page for the package build queue. - - 2. Choose the queue service role, then choose **Edit queue**. - - 3. Scroll to the **Queue service role** section, then choose **View this role in the IAM console**. - - 4. From the list of permission policies, choose the **AmazonDeadlineCloudQueuePolicy** for your queue. - - 5. From the **Permissions** tab, choose **Edit**. - - 6. Update the queue service role to the following. Replace `amzn-s3-demo-bucket` and `111122223333` with your own bucket and account. - - { - "Effect": "Allow", - "Sid": "CustomCondaChannelReadWrite", - "Action": [ - "s3:GetObject", - "s3:PutObject", - "s3:DeleteObject", - "s3:ListBucket", - "s3:GetBucketLocation" - ], - "Resource": [ - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/Conda/*" ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "111122223333" - } - } - }, + * [Automate package builds with Deadline Cloud](./automate-package-builds.html)