AWS batch documentation change
Summary
Added prerequisites for managed compute environments including security groups, IAM roles, and network access. Updated template examples.
Security assessment
Adds security-related prerequisites including security group configuration and IAM roles, which are security best practices. No specific vulnerability addressed.
Diff
diff --git a/batch/latest/userguide/compute-environment-template.md b/batch/latest/userguide/compute-environment-template.md index be1475372..c42af0327 100644 --- a//batch/latest/userguide/compute-environment-template.md +++ b//batch/latest/userguide/compute-environment-template.md @@ -10,0 +11,15 @@ The following example shows an empty compute environment template. You can use t +Before creating a managed Amazon EC2 compute environment, make sure you have the following prerequisites in place. These prerequisites apply when the `type` field is set to `MANAGED`. + + * **Security group** – Your compute resources require a security group that allows outbound traffic so that instances can communicate with the Amazon ECS service endpoint and pull container images. For more information, see [Create a security group](./create-a-base-security-group.html). + + * **IAM roles** – AWS Batch requires an Amazon ECS instance role that allows container instances to make AWS API calls on your behalf. For more information, see [Amazon ECS instance role](./instance_IAM_role.html) and [Using service-linked roles for AWS Batch](./using-service-linked-roles.html). + +###### Note + +The `instanceRole` field accepts an instance profile ARN, not a role ARN. The format is `arn:aws:iam::`account_id`:instance-profile/`ecsInstanceRole``. + + * **Network access** – Compute resources must be able to reach the Amazon ECS service endpoint. If your instances are in a private subnet without a public IP address, you can use either a NAT gateway or Amazon VPC interface endpoints. For more information, see [Use an interface endpoint to Access AWS Batch](./vpc-interface-endpoints.html). + + + + @@ -17,0 +33,6 @@ You can generate a compute environment template with the following AWS CLI comma +###### Important + +Compute environments must be created in `ENABLED` state. + +The following example shows a skeleton template for a **managed Amazon EC2 compute environment**. The `computeResources` block is required when `type` is `MANAGED`. + @@ -21,3 +42,2 @@ You can generate a compute environment template with the following AWS CLI comma - "type": "UNMANAGED", - "state": "DISABLED", - "unmanagedvCpus": 0, + "type": "MANAGED", + "state": "ENABLED", @@ -28 +48 @@ You can generate a compute environment template with the following AWS CLI comma - "maxvCpus": 0, + "maxvCpus": 16, @@ -31 +51 @@ You can generate a compute environment template with the following AWS CLI comma - "" + "default_arm64" @@ -33 +52,0 @@ You can generate a compute environment template with the following AWS CLI comma - "imageId": "", @@ -35 +54 @@ You can generate a compute environment template with the following AWS CLI comma - "" + "subnet-a1b2c3d4" @@ -38 +57 @@ You can generate a compute environment template with the following AWS CLI comma - "" + "sg-a1b2c3d4" @@ -40,2 +59 @@ You can generate a compute environment template with the following AWS CLI comma - "ec2KeyPair": "", - "instanceRole": "", + "instanceRole": "arn:aws:iam::123456789012:instance-profile/ecsInstanceRole", @@ -45,3 +62,0 @@ You can generate a compute environment template with the following AWS CLI comma - "placementGroup": "", - "bidPercentage": 0, - "spotIamFleetRole": "", @@ -50,2 +65 @@ You can generate a compute environment template with the following AWS CLI comma - "launchTemplateName": "", - "version": "" + "version": "$Default" @@ -55,3 +69 @@ You can generate a compute environment template with the following AWS CLI comma - "imageType": "", - "imageIdOverride": "", - "imageKubernetesVersion": "" + "imageType": "ECS_AL2023" @@ -64,4 +76,14 @@ You can generate a compute environment template with the following AWS CLI comma - }, - "eksConfiguration": { - "eksClusterArn": "", - "kubernetesNamespace": "" + } + } + +The following example shows a skeleton template for an **unmanaged Amazon EC2 compute environment**. The `computeResources` block is not used for `UNMANAGED` compute environments and should be omitted. + + + { + "computeEnvironmentName": "", + "type": "UNMANAGED", + "state": "ENABLED", + "unmanagedvCpus": 0, + "serviceRole": "", + "tags": { + "KeyName": ""