Bug #12212

[arvados-node-manager] Instance-profile ARN request

Added by Nico César 5 months ago. Updated 5 months ago.

Status:
Resolved
Priority:
Normal
Assigned To:
Category:
-
Target version:
-
Start date:
09/01/2017
Due date:
% Done:

0%

Estimated time:
Story points:
-

Description

When creating a instance, is good to have the option of an instance-profile ARN so some policies con be applied ( for example as in https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-restrict-vpc/ )

the config file should have instance_profile_arn that is something similar to: "arn:aws:iam::ACCOUNTNUMBER:instance-profile/ROLENAME"

Associated revisions

Revision a1d09f06
Added by Lucas Di Pentima 5 months ago

Merge branch '12212-aws-instance-profile'
refs #12212

Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <>

History

#1 Updated by Lucas Di Pentima 5 months ago

  • Status changed from New to In Progress
  • Assigned To set to Lucas Di Pentima

#2 Updated by Lucas Di Pentima 5 months ago

Reading nodemanager's code I noticed this bit on services/nodemanager/arvnodeman/config.py:

def new_cloud_client(self):
        module = importlib.import_module('arvnodeman.computenode.driver.' +
                                         self.get('Cloud', 'provider'))
        driver_class = module.ComputeNodeDriver.DEFAULT_DRIVER
        if self.has_option('Cloud', 'driver_class'):
            d = self.get('Cloud', 'driver_class').split('.')
            mod = '.'.join(d[:-1])
            cls = d[-1]
            driver_class = importlib.import_module(mod).__dict__[cls]
        auth_kwargs = self.get_section('Cloud Credentials')
        if 'timeout' in auth_kwargs:
            auth_kwargs['timeout'] = int(auth_kwargs['timeout'])
        return module.ComputeNodeDriver(auth_kwargs,
                                        self.get_section('Cloud List'),
                                        self.get_section('Cloud Create'),
                                        driver_class=driver_class)

It seems that simply adding the following at the [Cloud Create] config file section, will do the trick:

ex_iamprofile = arn:aws:iam::ACCOUNTNUMBER:instance-profile/ROLENAME

#3 Updated by Lucas Di Pentima 5 months ago

Added config example at fdfa24a94

#4 Updated by Nico César 5 months ago

  • Status changed from In Progress to Resolved

#5 Updated by Lucas Di Pentima 5 months ago

Should I merge the small update (fdfa24a94)?

#6 Updated by Lucas Di Pentima 5 months ago

Also added the example to the online docs - ef5d9a98b

Also available in: Atom PDF