(3.7.0‐3.15.1) Cannot deploy login nodes with ParallelCluster API, UI, CloudFormation Custom Resource and Terraform

The issue

Clusters that include login nodes may fail to create or update when deployed through the ParallelCluster API or the CloudFormation Custom Resource. When a cluster hits this issue, the login nodes nested stack reports the following error on the AWS::ElasticLoadBalancingV2::Listener resource:

Encountered a permissions error performing a tagging operation, please add required tag permissions. 

Affected ParallelCluster versions, OSes and schedulers

This affects ParallelCluster versions 3.7.0 through 3.15.1, across all OSes and schedulers, for clusters that include login nodes and are deployed through the ParallelCluster API or the CloudFormation Custom Resource. As a result, ParallelCluster UI and ParallelCluster for Terraform are also impacted, since both rely on the ParallelCluster API.

Mitigation

In case you see this issue, grant the following permission to the ParallelCluster API Lambda or the ParallelCluster CloudFormation Provider, depending on which one is affected in your setup.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateListener"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/parallelcluster:cluster-name": "false"
        }
      }
    }
  ]
}

Create a new IAM policy with the permission above, then specify its ARN in the appropriate stack parameter:

• ParallelCluster API: set the ARN in the ParallelClusterFunctionAdditionalPolicies stack parameter.
  • If you deploy the API through Terraform, set this parameter directly.
  • If you deploy the API through ParallelCluster UI, set it through the AdditionalPoliciesPCAPI parameter on the ParallelCluster UI stack, which forwards the ARN to the API stack.
• ParallelCluster CloudFormation Provider: set the ARN in the AdditionalIamPolicies stack parameter.