Skip to content

[Permissions] Add new stack parameter 'AdditionalPoliciesPCAPI' to add custom permissions for the ParallelCluster API Lambda role, on top of the default ones. #394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 5, 2025
+14 −0
Merged

[Permissions] Add new stack parameter 'AdditionalPoliciesPCAPI' to add custom permissions for the ParallelCluster API Lambda role, on top of the default ones. #394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions infrastructure/environments/demo-cfn-create-args.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ Parameters:
# ParameterValue: "subnet-xxxxxxxxxx,subnet-xxxxxxxxxx,subnet-xxxxxxxxxx"
# - ParameterKey: LambdaSecurityGroupIds
# ParameterValue: sg-xxxxxxxxxx
# - ParameterKey: AdditionalPoliciesPCAPI
# ParameterValue: arn:aws:iam::xxxxxxxxxx:policy/xxxxxxxxxx
# - ParameterKey: PermissionsBoundaryPolicy
# ParameterValue: arn:aws:iam::xxxxxxxxxx:policy/xxxxxxxxxx
# - ParameterKey: PermissionsBoundaryPolicyPCAPI
Expand Down
2 changes: 2 additions & 0 deletions infrastructure/environments/demo-cfn-update-args.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ Parameters:
UsePreviousValue: true
- ParameterKey: LambdaSecurityGroupIds
UsePreviousValue: true
- ParameterKey: AdditionalPoliciesPCAPI
UsePreviousValue: true
- ParameterKey: PermissionsBoundaryPolicy
UsePreviousValue: true
- ParameterKey: PermissionsBoundaryPolicyPCAPI
Expand Down
10 changes: 10 additions & 0 deletions infrastructure/parallelcluster-ui.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,13 @@ Parameters:
Description: 'ARN of the IAM policy to use as permissions boundary for every IAM role created by ParallelCluster API infrastructure. [ParallelCluster >= 3.8.0]'
Default: ''
AllowedPattern: "^(arn:.*:iam::.*:policy\\/([a-zA-Z0-9_-]+))|()$"
AdditionalPoliciesPCAPI:
Type: String
Description: |
(OPTIONAL) ARN of the additional IAM policy to be attached to the default execution role for the ParallelCluster Lambda function.
Only one policy can be specified.
Default: ''
AllowedPattern: "^(arn:.*:iam::.*:policy\\/([a-zA-Z0-9_-]+))|()$"
IAMRoleAndPolicyPrefix:
Type: String
Description: 'Prefix applied to the name of every IAM role and policy (max length: 10). [ParallelCluster >= 3.8.0]'
Expand Down Expand Up @@ -113,6 +120,7 @@ Metadata:
- Label:
default: (Optional) Permissions
Parameters:
- AdditionalPoliciesPCAPI
- IAMRoleAndPolicyPrefix
- PermissionsBoundaryPolicy
- PermissionsBoundaryPolicyPCAPI
Expand Down Expand Up @@ -169,6 +177,7 @@ Conditions:
UseIAMRoleAndPolicyPrefix: !Not [!Equals [!Ref IAMRoleAndPolicyPrefix, '']]
UseCustomDomain: !Not [!Equals [!Ref CustomDomain, '']]
UseCognitoCustomDomain: !Not [!Equals [!Ref CognitoCustomDomain, '']]
UseAdditionalPoliciesPCAPI: !Not [!Equals [!Ref AdditionalPoliciesPCAPI, '']]

Mappings:
ParallelClusterUI:
Expand Down Expand Up @@ -204,6 +213,7 @@ Resources:
Parameters:
PermissionsBoundaryPolicy: !If [ UsePermissionBoundaryPCAPI, !Ref PermissionsBoundaryPolicyPCAPI, !Ref AWS::NoValue ]
IAMRoleAndPolicyPrefix: !If [ UseIAMRoleAndPolicyPrefix, !Ref IAMRoleAndPolicyPrefix, !Ref AWS::NoValue ]
ParallelClusterFunctionAdditionalPolicies: !If [ UseAdditionalPoliciesPCAPI, !Ref AdditionalPoliciesPCAPI, !Ref AWS::NoValue ]
ApiDefinitionS3Uri: !Sub s3://${AWS::Region}-aws-parallelcluster/parallelcluster/${Version}/api/ParallelCluster.openapi.yaml
CreateApiUserRole: False
EnableIamAdminAccess: True
Expand Down
Loading