Elastic High Performance Computing:Reference for E-HPC custom policies

What is a custom policy?

Resource Access Management (RAM) policies fall into two categories: system policies and custom policies. Custom policies give you full control over the permissions defined.

• After you create a custom policy, attach it to a RAM user, RAM user group, or RAM role to grant the specified permissions to that principal.

• To delete a custom policy that is attached to a principal, first detach it from the principal.

• Custom policies support version management. Use the RAM version management mechanism to manage policy versions.

Authorization information

To use custom policies, you need to learn about the requirements on service permissions and E-HPC authorization. For more information, see RAM authorization.

References

To create and manage custom policies, see:

• Create a custom policy

• Modify the document and description of a custom policy

• Delete a custom policy

• Manage policy references

• Manage custom policy versions

Grant a RAM user permission to create an E-HPC cluster using existing resources

The following policy allows a RAM user to create a cluster using existing resources — a virtual private cloud (VPC) and a File Storage NAS file system — without granting permissions to create new instances of those resources.

To grant additional permissions beyond this baseline, see the subsections below.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ram:GetRole",
                "ram:CheckServiceLinkedRoleExistence",
                "ram:ListResourceGroups"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "vpc:DescribeEipAddresses",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cms:QueryMetricList",
                "cms:QueryMetricLast"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeEipPrice",
                "ecs:DescribePrice",
                "ecs:DescribeKeyPairs",
                "ecs:DescribeSecurityGroups",
                "ecs:DescribeInstances",
                "ecs:RebootInstance",
                "ecs:RebootInstances",
                "ecs:DescribeCloudAssistantStatus",
                "ecs:DescribeUserBusinessBehavior",
                "ecs:ModifyUserBusinessBehavior",
                "ecs:DescribeCloudAssistantSettings",
                "ecs:RunCommand",
                "ecs:DescribeInvocations",
                "ecs:ListServiceSettings"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "nas:DescribeProtocolMountTarget",
                "nas:DescribeFilesets",
                "nas:DescribeFileSystems"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "bssapi:DescribeInstanceBill",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ehpc:*",
            "Resource": "*"
        }
    ]
}