IAM StarCluster需要的权限

Question

我正在关注StarCluster configuration instructions，我想为StarCluster创建一个新用户来使用。我的问题是StarCluster需要运行的最小IAM权限集是什么？

是否需要AmazonEC2FullAccess策略（如indicated by this）或是否存在不太全面的策略。

Answer 1

我已经使用了以下政策，以允许用户IAM开始t2.micro实例（只）

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "ExtraActionsNeededByStarCluster", 
      "Effect": "Allow", 
      "Action": [ 
       "ec2:CreateKeyPair", 
       "ec2:CreateSecurityGroup", 
       "ec2:DeleteSecurityGroup", 
       "ec2:AuthorizeSecurityGroup", 
       "ec2:CreateTags", 
       "ec2:DeleteTags", 
       "ec2:AuthorizeSecurityGroupIngress", 
       "ec2:TerminateInstances" 
      ], 
      "Resource": "*" 
     }, 
     { 
      "Sid": "AllowDescribeForAllResources", 
      "Effect": "Allow", 
      "Action": [ 
       "ec2:Describe*" 
      ], 
      "Resource": "*" 
     }, 
     { 
      "Sid": "OnlyAllowCertainInstanceTypesToBeCreated", 
      "Effect": "Allow", 
      "Action": [ 
       "ec2:RunInstances" 
      ], 
      "Resource": [ 
       "*" 
      ], 
      "Condition": { 
       "StringEquals": { 
        "ec2:InstanceType": [ 
         "t2.micro" 
        ] 
       } 
      } 
     }, 
     { 
      "Sid": "AllowUserToStopStartDeleteInstances", 
      "Effect": "Allow", 
      "Action": [ 
       "ec2:TerminateInstances", 
       "ec2:StopInstances", 
       "ec2:StartInstances" 
      ], 
      "Resource": "arn:aws:ec2:*:account:instance/*" 
     } 
    ] 
} 

Answer 2

政策上面会不会让你安装EBS卷上的情况下，或者使用贴片组，或进行现场投标。我们似乎已经计算出运行starcluster vanillaimprovements的IAM用户所需的全套权限，包括现场出价和负载平衡器addnodes和removenodes：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "ExtraActionsNeededByStarCluster", 
      "Effect": "Allow", 
      "Action": [ 
       "ec2:CreateKeyPair", 
       "ec2:CreateSecurityGroup", 
       "ec2:DeleteSecurityGroup", 
       "ec2:AuthorizeSecurityGroupEgress", 
       "ec2:CreateTags", 
       "ec2:DeleteTags", 
       "ec2:AuthorizeSecurityGroupIngress", 
       "ec2:TerminateInstances", 
       "ec2:CreatePlacementGroup", 
       "ec2:DeletePlacementGroup", 
       "ec2:RequestSpotInstances", 
       "ec2:CancelSpotInstanceRequests" 
      ], 
      "Resource": "*" 
     }, 
     { 
      "Sid": "AllowDescribeForAllResources", 
      "Effect": "Allow", 
      "Action": "ec2:Describe*", 
      "Resource": "*" 
     }, 
     { 
      "Sid": "AllowInstancesToBeCreated", 
      "Effect": "Allow", 
      "Action": "ec2:RunInstances", 
      "Resource": "*" 
     }, 
     { 
      "Sid": "AllowUserToStopStartDeleteInstances", 
      "Effect": "Allow", 
      "Action": [ 
       "ec2:TerminateInstances", 
       "ec2:StopInstances", 
       "ec2:StartInstances" 
      ], 
      "Resource": "arn:aws:ec2:*:account:instance/*" 
     } 
    ] 
}