aws / aws/aws-parallelcluster

[Feature Request] Customizable Max Session Duration for PCluster-created IAM roles in PCluster 3.X.X

Open
#5,330 0 comments 0 reactions 0 assignees View on GitHub
3.x enhancement Feature Request
Dominant language
Python
Stars
888
Forks
314
Avg merge
1d 10h
Merged PRs (30d)
43

Description

- AWS ParallelCluster version [e.g. 3.1.1]: PCluster 3.4.1

**Description and how to reproduce:**
We currently spin-up short-lived clusters multiple times a day with PCluster 3.4.1. In our PCluster config YAML, we set the "AdditionalIam Policies" for both the HeadNode and the ComputeResources such that PCluster creates and manages the respective IAM roles for the cluster instances.

On rare occasion, while attempting to access AWS resources via python3 (boto3 and botocore) from a job submitted to a Slurm queue, we get a `botocore.exceptions.NoCredentialsError: Unable to locate credentials` error. We suspect this error is happening because the code is attempting to access AWS resources at the same exact time the AWS credentials set by the PCluster-created role expire and/or are rotated. We have been unable to consistently reproduce given the short-lived nature of the race-condition.

By default, the roles created via PCluster have a maximum session duration of 1 hour. It looks like this could be customizable (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-maxsessionduration), and it would be great if PCluster could include such an option within the PCluster configuration YAML. Thanks!

- Stefan

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.