AWS parallelcluster documentation change
Summary
Updated security group configuration to require bidirectional traffic between client and FSx Lustre, and modified EFA client setup instructions to use user-hosted scripts instead of public bucket
Security assessment
The change adds explicit inbound security group rules required for EFA communication and promotes secure practices by instructing users to host configuration scripts in their own S3 buckets rather than using public buckets. This reduces reliance on external resources and allows better access control, but there's no evidence it addresses a specific security vulnerability.
Diff
diff --git a/parallelcluster/latest/ug/tutorial-efa-enabled-fsx-lustre.md b/parallelcluster/latest/ug/tutorial-efa-enabled-fsx-lustre.md index 3218956ac..522600bef 100644 --- a//parallelcluster/latest/ug/tutorial-efa-enabled-fsx-lustre.md +++ b//parallelcluster/latest/ug/tutorial-efa-enabled-fsx-lustre.md @@ -50 +50 @@ In the remainder of the tutorial, we will assume `sg-client` and `sg-file-system -Configure the security group for the client to allow all outbound traffic to the file system, as [required by EFA](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa-start.html#efa-start-security). +Configure the security group for the client to allow all inbound/outbound traffic to and from the file system, as [required by EFA](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa-start.html#efa-start-security). @@ -52,0 +53,8 @@ Configure the security group for the client to allow all outbound traffic to the + # Allow all inbound traffic from the file system to the client + aws ec2 authorize-security-group-ingress \ + --group-id sg-client \ + --protocol -1 \ + --port -1 \ + --source-group sg-file-system \ + --region region + @@ -124 +132,18 @@ Take note of the file system id returned by the previous command. In the remaind - * Compute nodes must run the configuration script `configure-efa-fsx-lustre-client.sh` as an [OnNodeStart](./Scheduling-v3.html#yaml-Scheduling-SlurmQueues-CustomActions-OnNodeStart) custom action. The script, provided in the [FSx official documentation](https://docs.aws.amazon.com/fsx/latest/LustreGuide/configure-efa-clients.html) and offered in our public bucket for your convenience, is meant to configure the FSx Lustre client on compute nodes to let them use EFA. + * Compute nodes must configure the FSx Lustre client to use EFA by following [Configuring EFA clients](https://docs.aws.amazon.com/fsx/latest/LustreGuide/configure-efa-clients.html) in the _FSx for Lustre User Guide_. That guide provides the `configure-efa-fsx-lustre-client` package, which you download, extract, and run with `setup.sh`. To apply it automatically on every compute node, run these steps from an [OnNodeStart](./Scheduling-v3.html#yaml-Scheduling-SlurmQueues-CustomActions-OnNodeStart) custom action, as shown below. + + * Create the file `configure-efa-fsx-lustre-client-wrapper.sh` and upload it to a bucket, for example `your-bucket`, that is reachable from the compute nodes. Following the steps in the FSx documentation referenced above, the wrapper performs the equivalent of: + + #!/bin/bash + set -euo pipefail + + # Download the FSx Lustre EFA client configuration package. + # See: https://docs.aws.amazon.com/fsx/latest/LustreGuide/configure-efa-clients.html + # Replace the source below with a location reachable from your compute nodes + # (for example, your own S3 bucket populated from the FSx documentation package). + cd /tmp + aws s3 cp s3://your-bucket/configure-efa-fsx-lustre-client.zip . + unzip -o configure-efa-fsx-lustre-client.zip + cd configure-efa-fsx-lustre-client + + # Configure the FSx Lustre client to use EFA. + ./setup.sh @@ -157,0 +183,3 @@ Take note of the file system id returned by the previous command. In the remaind + Iam: + S3Access: + - BucketName: your-bucket @@ -160 +188,2 @@ Take note of the file system id returned by the previous command. In the remaind - Script: https://us-east-1-aws-parallelcluster.s3.us-east-1.amazonaws.com/scripts/fsx-lustre-efa/configure-efa-fsx-lustre-client.sh + # Point this at the wrapper script you created and hosted (see step above). + Script: s3://your-bucket/configure-efa-fsx-lustre-client-wrapper.sh