When you use Elastic High Performance Computing (E-HPC), you must create the AliyunECSInstanceForEHPCRole service role and attach the AliyunECSInstanceForEHPCRolePolicy policy to it. This topic explains how to create, view, and delete the role.
How it works
E-HPC uses two levels of permissions:
RAM user permissions — control what operations a RAM user can perform through the E-HPC console or API, such as creating clusters and managing nodes.
Service role permissions — granted to ECS instances in the cluster so they can call other cloud services (ECS, VPC, and File Storage NAS) on your behalf.
The normal service role AliyunECSInstanceForEHPCRole handles the second level. It is a Resource Access Management (RAM) role whose trusted entity is an Alibaba Cloud service. For more information about RAM roles, see Overview.
Service role and system policy
E-HPC provides the following role and policy:
| Resource | Name |
|---|---|
| Normal service role | AliyunECSInstanceForEHPCRole |
| System policy | AliyunECSInstanceForEHPCRolePolicy |
AliyunECSInstanceForEHPCRole authorizes ECS instances in your E-HPC cluster to access Elastic Compute Service (ECS), Virtual Private Cloud (VPC), and File Storage NAS.
RAM user permissions required to manage the normal service role
If a RAM user (rather than an Alibaba Cloud account owner) needs to create or delete the normal service role, the account owner must grant the RAM user the required permissions first.
Method 1 — Quick setup: Grant the AliyunEHPCFullAccess policy. This policy includes the permissions to create and delete AliyunECSInstanceForEHPCRole and is suitable for most users.
Method 2 — Least-privilege access: Add the following actions to the
Actionstatement of a custom policy. Use this method if your organization requires minimizing granted permissions.Operation Action Create the normal service role ram:CreateRoleDelete the normal service role ram:DeleteRole
Create the normal service role
When you first use E-HPC, the system checks whether AliyunECSInstanceForEHPCRole exists in your account. If it does not exist, a notification appears. After you confirm, the system automatically creates AliyunECSInstanceForEHPCRole and attaches AliyunECSInstanceForEHPCRolePolicy to it.
The policy grants the following permissions:
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:RunInstances",
"ecs:StartInstances",
"ecs:StopInstances",
"ecs:DeleteInstances",
"ecs:DescribeInstances",
"cms:QueryMetricLast",
"cms:QueryMetricList",
"ess:DescribeScalingConfigurations",
"ess:ModifyScalingConfiguration",
"ess:ModifyScalingRule",
"ess:ExecuteScalingRule",
"ess:RemoveInstances",
"oss:PutObject",
"oss:GetObject",
"oss:ListObjects",
"oss:ListBuckets",
"ehpc:*",
"ecs:CreateCommand",
"ecs:InvokeCommand",
"ecs:RunCommand",
"ecs:DescribeCommands",
"ecs:DescribeSecurityGroupAttribute",
"ecs:ListSecurityGroups",
"ecs:AuthorizeSecurityGroup"
],
"Resource": "*",
"Effect": "Allow"
}
]
}The permissions cover these functional areas:
| Area | Actions |
|---|---|
| ECS instance management | ecs:RunInstances, ecs:StartInstances, ecs:StopInstances, ecs:DeleteInstances, ecs:DescribeInstances |
| Monitoring | cms:QueryMetricLast, cms:QueryMetricList |
| Auto scaling | ess:DescribeScalingConfigurations, ess:ModifyScalingConfiguration, ess:ModifyScalingRule, ess:ExecuteScalingRule, ess:RemoveInstances |
| OSS access | oss:PutObject, oss:GetObject, oss:ListObjects, oss:ListBuckets |
| E-HPC operations | ehpc:* |
| ECS commands and security groups | ecs:CreateCommand, ecs:InvokeCommand, ecs:RunCommand, ecs:DescribeCommands, ecs:DescribeSecurityGroupAttribute, ecs:ListSecurityGroups, ecs:AuthorizeSecurityGroup |
AliyunECSInstanceForEHPCRolePolicy is a system policy and cannot be modified. To grant the role additional permissions, attach a custom policy to AliyunECSInstanceForEHPCRole in the RAM console.
View the normal service role
After the role is created, view its details in the RAM console:
Go to the Roles page in the RAM console.
Search for AliyunECSInstanceForEHPCRole.
Click the role name to open its detail page.
The detail page has three sections:
| Section | What you can see |
|---|---|
| Basic Information | Role name, creation time, Alibaba Cloud Resource Name (ARN), and description |
| Permissions tab | Policy content and the cloud resources the role can access — click a policy name to view details |
| Trust Policy Management tab | The trust policy attached to the role. Check the Service field to confirm the trusted entity (a cloud service) |
For more information, see View the information about a RAM role.
Limitations and permission extension
The AliyunECSInstanceForEHPCRole role is required for control plane nodes and logon nodes. Do not detach or replace this role in the ECS console. Detaching the role from a control plane node disables automatic scaling for the cluster. Detaching the role from a logon node causes the Web Portal feature to fail.
Attach a custom policy to the service role
To grant nodes additional API permissions, attach a custom policy to the AliyunECSInstanceForEHPCRole role. Do not detach or replace the role. Use the following steps:
Log on to the RAM console.
In the navigation pane on the left, choose Identities > Roles.
Search for and click
AliyunECSInstanceForEHPCRolein the role list.On the Permissions tab, click Attach Policy, and then select or create the required custom policy.
Click OK to complete the authorization.
For more information, see Basic elements of a policy.
Delete the service role
After you delete the service role, features that depend on it no longer work. Proceed with caution.
If you do not use E-HPC for an extended period, you can manually delete the service role in the RAM console. For detailed steps, see Delete a RAM role.
Before you delete AliyunECSInstanceForEHPCRole, ensure the following conditions are met:
You no longer need this service role. For example, you do not need to create clusters or manage cluster nodes.
You have released all E-HPC clusters that depend on this service role. For more information, see Release a cluster.