From 9fc2ae78172ab64d2df0a0474813b7e166014131 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Thu, 11 Aug 2022 17:35:33 +0100 Subject: [PATCH 01/13] Integration test with EFA in a launch template --- .../aws-batch/test/integ.batch-with-efa.ts | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts new file mode 100644 index 0000000000000..9a5ba799a6530 --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -0,0 +1,48 @@ +import * as ec2 from '@aws-cdk/aws-ec2'; +import * as cdk from '@aws-cdk/core'; +import * as integ from '@aws-cdk/integ-tests'; +import * as batch from '../lib/'; + +export const app = new cdk.App(); + +const stack = new cdk.Stack(app, 'batch-stack'); + +const vpc = new ec2.Vpc(stack, 'vpc'); + +const launchTemplate = new ec2.CfnLaunchTemplate(stack, 'ec2-launch-template', { + launchTemplateName: 'EC2LaunchTemplate', + launchTemplateData: { + networkInterfaces: [{ + deviceIndex: 0, + subnetId: vpc.privateSubnets[0].subnetId, + interfaceType: 'efa', + }], + }, +}); + +const computeEnvironment = new batch.ComputeEnvironment(stack, 'EFABatch', { + managed: true, + computeResources: { + type: batch.ComputeResourceType.ON_DEMAND, + instanceTypes: [new ec2.InstanceType('c5n')], + vpc, + launchTemplate: { + launchTemplateName: launchTemplate.launchTemplateName as string, + }, + }, +}); + +new batch.JobQueue(stack, 'batch-job-queue', { + computeEnvironments: [ + { + computeEnvironment, + order: 1, + }, + ], +}); + +new integ.IntegTest(app, 'BatchWithEFSTest', { + testCases: [stack], +}); + +app.synth(); \ No newline at end of file From c8b95bea854a0492f7439ec3689a4cef34dc1363 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Fri, 12 Aug 2022 09:41:17 +0100 Subject: [PATCH 02/13] Name resources with EFA --- .../aws-batch/test/integ.batch-with-efa.ts | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts index 9a5ba799a6530..ad72d421bc5f0 100644 --- a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -7,10 +7,13 @@ export const app = new cdk.App(); const stack = new cdk.Stack(app, 'batch-stack'); -const vpc = new ec2.Vpc(stack, 'vpc'); +// Don't need multiAZ for this test +const vpc = new ec2.Vpc(stack, 'vpc', { maxAzs: 1 }); -const launchTemplate = new ec2.CfnLaunchTemplate(stack, 'ec2-launch-template', { - launchTemplateName: 'EC2LaunchTemplate', +// While this test specifies EFA, the same behavior occurs with +// interfaceType: 'interface' as well +const launchTemplateEFA = new ec2.CfnLaunchTemplate(stack, 'ec2-launch-template-efa', { + launchTemplateName: 'EC2LaunchTemplateEFA', launchTemplateData: { networkInterfaces: [{ deviceIndex: 0, @@ -20,28 +23,29 @@ const launchTemplate = new ec2.CfnLaunchTemplate(stack, 'ec2-launch-template', { }, }); -const computeEnvironment = new batch.ComputeEnvironment(stack, 'EFABatch', { +const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFABatch', { managed: true, computeResources: { type: batch.ComputeResourceType.ON_DEMAND, instanceTypes: [new ec2.InstanceType('c5n')], vpc, launchTemplate: { - launchTemplateName: launchTemplate.launchTemplateName as string, + launchTemplateName: launchTemplateEFA.launchTemplateName as string, }, }, }); + new batch.JobQueue(stack, 'batch-job-queue', { computeEnvironments: [ { - computeEnvironment, + computeEnvironment: computeEnvironmentEFA, order: 1, }, ], }); -new integ.IntegTest(app, 'BatchWithEFSTest', { +new integ.IntegTest(app, 'BatchWithEFATest', { testCases: [stack], }); From d3f88a942a88ac169e77bb9515bd31fc453e5512 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Fri, 12 Aug 2022 09:41:35 +0100 Subject: [PATCH 03/13] Name resources with EFA --- packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts index ad72d421bc5f0..232147c6eb1bf 100644 --- a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -7,8 +7,7 @@ export const app = new cdk.App(); const stack = new cdk.Stack(app, 'batch-stack'); -// Don't need multiAZ for this test -const vpc = new ec2.Vpc(stack, 'vpc', { maxAzs: 1 }); +const vpc = new ec2.Vpc(stack, 'vpc'); // While this test specifies EFA, the same behavior occurs with // interfaceType: 'interface' as well From f1828aa2f65e1a590915e155abbc484c362af1d0 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Fri, 12 Aug 2022 12:28:42 +0100 Subject: [PATCH 04/13] ComputeEnvironmentSecurityGroups flag added --- .../aws-batch/lib/compute-environment.ts | 33 +- ...aultTestDeployAssertDAD33663.template.json | 1 + .../batch-stack.template.json | 448 +++++++++++ .../batch-with-efa.integ.snapshot/cdk.out | 1 + .../batch-with-efa.integ.snapshot/integ.json | 11 + .../manifest.json | 151 ++++ .../batch-with-efa.integ.snapshot/tree.json | 704 ++++++++++++++++++ .../test/compute-environment.test.ts | 53 +- .../aws-batch/test/integ.batch-with-efa.ts | 12 +- 9 files changed, 1407 insertions(+), 7 deletions(-) create mode 100644 packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json create mode 100644 packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json create mode 100644 packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out create mode 100644 packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json create mode 100644 packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json create mode 100644 packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index 5e3b954bef541..7995e4fe85501 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -33,6 +33,25 @@ export enum ComputeResourceType { */ FARGATE_SPOT = 'FARGATE_SPOT', } +/** + * Flag to determine whether or not the ComputeEnvironment should + * autocreate Security Groups. + */ +export enum ComputeEnvironmentSecurityGroups { + /** + * The Compute Environment will not create any security groups + * + * This is needed if you are instead assigning security groups + * to network interfaces defined in a launch template + */ + NONE = 'NONE', + /** + * The Compute Environment will create security groups if none + * are explicity specified + * to network interfaces defined in a launch template + */ + AUTOMATIC = 'AUTOMATIC', +} /** * Properties for how to prepare compute resources @@ -142,7 +161,7 @@ export interface ComputeResources { * * @default - AWS default security group. */ - readonly securityGroups?: ec2.ISecurityGroup[]; + readonly securityGroups?: ec2.ISecurityGroup[] | ComputeEnvironmentSecurityGroups; /** * The VPC network that all compute resources will be connected to. @@ -584,13 +603,14 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, return instanceTypes.map((type: ec2.InstanceType) => type.toString()); } - private buildConnections(vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[]): ec2.Connections { + private buildConnections(vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[] | ComputeEnvironmentSecurityGroups ): ec2.Connections { if (vpc === undefined) { return new ec2.Connections({}); } - if (securityGroups === undefined) { + if (securityGroups === undefined || + securityGroups == ComputeEnvironmentSecurityGroups.AUTOMATIC) { return new ec2.Connections({ securityGroups: [ new ec2.SecurityGroup(this, 'Resource-Security-Group', { vpc }), @@ -598,11 +618,16 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, }); } + if (securityGroups === ComputeEnvironmentSecurityGroups.NONE) { + return new ec2.Connections({}); + } + return new ec2.Connections({ securityGroups }); }; private getSecurityGroupIds(): string[] | undefined { - if (this.connections === undefined) { + if (this.connections === undefined || + this.connections.securityGroups.length < 1) { return undefined; } diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json new file mode 100644 index 0000000000000..9e26dfeeb6e64 --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json new file mode 100644 index 0000000000000..6e1cd76577558 --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json @@ -0,0 +1,448 @@ +{ + "Resources": { + "vpcA2121C38": { + "Type": "AWS::EC2::VPC", + "Properties": { + "CidrBlock": "10.0.0.0/16", + "EnableDnsHostnames": true, + "EnableDnsSupport": true, + "InstanceTenancy": "default", + "Tags": [ + { + "Key": "Name", + "Value": "batch-stack/vpc" + } + ] + } + }, + "vpcPublicSubnet1Subnet2E65531E": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "VpcId": { + "Ref": "vpcA2121C38" + }, + "AvailabilityZone": { + "Fn::Select": [ + 0, + { + "Fn::GetAZs": "" + } + ] + }, + "CidrBlock": "10.0.0.0/17", + "MapPublicIpOnLaunch": true, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Public" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Public" + }, + { + "Key": "Name", + "Value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "vpcPublicSubnet1RouteTable48A2DF9B": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "vpcA2121C38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "vpcPublicSubnet1RouteTableAssociation5D3F4579": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "vpcPublicSubnet1RouteTable48A2DF9B" + }, + "SubnetId": { + "Ref": "vpcPublicSubnet1Subnet2E65531E" + } + } + }, + "vpcPublicSubnet1DefaultRoute10708846": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "vpcPublicSubnet1RouteTable48A2DF9B" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "GatewayId": { + "Ref": "vpcIGWE57CBDCA" + } + }, + "DependsOn": [ + "vpcVPCGW7984C166" + ] + }, + "vpcPublicSubnet1EIPDA49DCBE": { + "Type": "AWS::EC2::EIP", + "Properties": { + "Domain": "vpc", + "Tags": [ + { + "Key": "Name", + "Value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "vpcPublicSubnet1NATGateway9C16659E": { + "Type": "AWS::EC2::NatGateway", + "Properties": { + "SubnetId": { + "Ref": "vpcPublicSubnet1Subnet2E65531E" + }, + "AllocationId": { + "Fn::GetAtt": [ + "vpcPublicSubnet1EIPDA49DCBE", + "AllocationId" + ] + }, + "Tags": [ + { + "Key": "Name", + "Value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "vpcPrivateSubnet1Subnet934893E8": { + "Type": "AWS::EC2::Subnet", + "Properties": { + "VpcId": { + "Ref": "vpcA2121C38" + }, + "AvailabilityZone": { + "Fn::Select": [ + 0, + { + "Fn::GetAZs": "" + } + ] + }, + "CidrBlock": "10.0.128.0/17", + "MapPublicIpOnLaunch": false, + "Tags": [ + { + "Key": "aws-cdk:subnet-name", + "Value": "Private" + }, + { + "Key": "aws-cdk:subnet-type", + "Value": "Private" + }, + { + "Key": "Name", + "Value": "batch-stack/vpc/PrivateSubnet1" + } + ] + } + }, + "vpcPrivateSubnet1RouteTableB41A48CC": { + "Type": "AWS::EC2::RouteTable", + "Properties": { + "VpcId": { + "Ref": "vpcA2121C38" + }, + "Tags": [ + { + "Key": "Name", + "Value": "batch-stack/vpc/PrivateSubnet1" + } + ] + } + }, + "vpcPrivateSubnet1RouteTableAssociation67945127": { + "Type": "AWS::EC2::SubnetRouteTableAssociation", + "Properties": { + "RouteTableId": { + "Ref": "vpcPrivateSubnet1RouteTableB41A48CC" + }, + "SubnetId": { + "Ref": "vpcPrivateSubnet1Subnet934893E8" + } + } + }, + "vpcPrivateSubnet1DefaultRoute1AA8E2E5": { + "Type": "AWS::EC2::Route", + "Properties": { + "RouteTableId": { + "Ref": "vpcPrivateSubnet1RouteTableB41A48CC" + }, + "DestinationCidrBlock": "0.0.0.0/0", + "NatGatewayId": { + "Ref": "vpcPublicSubnet1NATGateway9C16659E" + } + } + }, + "vpcIGWE57CBDCA": { + "Type": "AWS::EC2::InternetGateway", + "Properties": { + "Tags": [ + { + "Key": "Name", + "Value": "batch-stack/vpc" + } + ] + } + }, + "vpcVPCGW7984C166": { + "Type": "AWS::EC2::VPCGatewayAttachment", + "Properties": { + "VpcId": { + "Ref": "vpcA2121C38" + }, + "InternetGatewayId": { + "Ref": "vpcIGWE57CBDCA" + } + } + }, + "EFASecurityGroupB5A52193": { + "Type": "AWS::EC2::SecurityGroup", + "Properties": { + "GroupDescription": "batch-stack/EFASecurityGroup", + "SecurityGroupEgress": [ + { + "CidrIp": "0.0.0.0/0", + "Description": "Allow all outbound traffic by default", + "IpProtocol": "-1" + } + ], + "VpcId": { + "Ref": "vpcA2121C38" + } + } + }, + "ec2launchtemplateefa": { + "Type": "AWS::EC2::LaunchTemplate", + "Properties": { + "LaunchTemplateData": { + "NetworkInterfaces": [ + { + "DeviceIndex": 0, + "Groups": [ + { + "Fn::GetAtt": [ + "EFASecurityGroupB5A52193", + "GroupId" + ] + } + ], + "InterfaceType": "efa", + "SubnetId": { + "Ref": "vpcPrivateSubnet1Subnet934893E8" + } + } + ] + }, + "LaunchTemplateName": "EC2LaunchTemplateEFA" + } + }, + "EFABatchEcsInstanceRole9A232F28": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": { + "Fn::Join": [ + "", + [ + "ec2.", + { + "Ref": "AWS::URLSuffix" + } + ] + ] + } + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role" + ] + ] + } + ] + }, + "DependsOn": [ + "vpcIGWE57CBDCA", + "vpcPrivateSubnet1DefaultRoute1AA8E2E5", + "vpcPrivateSubnet1RouteTableB41A48CC", + "vpcPrivateSubnet1RouteTableAssociation67945127", + "vpcPrivateSubnet1Subnet934893E8", + "vpcPublicSubnet1DefaultRoute10708846", + "vpcPublicSubnet1EIPDA49DCBE", + "vpcPublicSubnet1NATGateway9C16659E", + "vpcPublicSubnet1RouteTable48A2DF9B", + "vpcPublicSubnet1RouteTableAssociation5D3F4579", + "vpcPublicSubnet1Subnet2E65531E", + "vpcA2121C38", + "vpcVPCGW7984C166" + ] + }, + "EFABatchInstanceProfile3450D107": { + "Type": "AWS::IAM::InstanceProfile", + "Properties": { + "Roles": [ + { + "Ref": "EFABatchEcsInstanceRole9A232F28" + } + ] + }, + "DependsOn": [ + "vpcIGWE57CBDCA", + "vpcPrivateSubnet1DefaultRoute1AA8E2E5", + "vpcPrivateSubnet1RouteTableB41A48CC", + "vpcPrivateSubnet1RouteTableAssociation67945127", + "vpcPrivateSubnet1Subnet934893E8", + "vpcPublicSubnet1DefaultRoute10708846", + "vpcPublicSubnet1EIPDA49DCBE", + "vpcPublicSubnet1NATGateway9C16659E", + "vpcPublicSubnet1RouteTable48A2DF9B", + "vpcPublicSubnet1RouteTableAssociation5D3F4579", + "vpcPublicSubnet1Subnet2E65531E", + "vpcA2121C38", + "vpcVPCGW7984C166" + ] + }, + "EFABatchResourceServiceInstanceRoleD10C6691": { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "batch.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSBatchServiceRole" + ] + ] + } + ] + }, + "DependsOn": [ + "vpcIGWE57CBDCA", + "vpcPrivateSubnet1DefaultRoute1AA8E2E5", + "vpcPrivateSubnet1RouteTableB41A48CC", + "vpcPrivateSubnet1RouteTableAssociation67945127", + "vpcPrivateSubnet1Subnet934893E8", + "vpcPublicSubnet1DefaultRoute10708846", + "vpcPublicSubnet1EIPDA49DCBE", + "vpcPublicSubnet1NATGateway9C16659E", + "vpcPublicSubnet1RouteTable48A2DF9B", + "vpcPublicSubnet1RouteTableAssociation5D3F4579", + "vpcPublicSubnet1Subnet2E65531E", + "vpcA2121C38", + "vpcVPCGW7984C166" + ] + }, + "EFABatchEC058146": { + "Type": "AWS::Batch::ComputeEnvironment", + "Properties": { + "Type": "MANAGED", + "ComputeResources": { + "AllocationStrategy": "BEST_FIT", + "InstanceRole": { + "Fn::GetAtt": [ + "EFABatchInstanceProfile3450D107", + "Arn" + ] + }, + "InstanceTypes": [ + "c5n.18xlarge" + ], + "LaunchTemplate": { + "LaunchTemplateName": "EC2LaunchTemplateEFA" + }, + "MaxvCpus": 256, + "MinvCpus": 0, + "Subnets": [ + { + "Ref": "vpcPrivateSubnet1Subnet934893E8" + } + ], + "Type": "EC2" + }, + "ServiceRole": { + "Fn::GetAtt": [ + "EFABatchResourceServiceInstanceRoleD10C6691", + "Arn" + ] + }, + "State": "ENABLED" + }, + "DependsOn": [ + "vpcIGWE57CBDCA", + "vpcPrivateSubnet1DefaultRoute1AA8E2E5", + "vpcPrivateSubnet1RouteTableB41A48CC", + "vpcPrivateSubnet1RouteTableAssociation67945127", + "vpcPrivateSubnet1Subnet934893E8", + "vpcPublicSubnet1DefaultRoute10708846", + "vpcPublicSubnet1EIPDA49DCBE", + "vpcPublicSubnet1NATGateway9C16659E", + "vpcPublicSubnet1RouteTable48A2DF9B", + "vpcPublicSubnet1RouteTableAssociation5D3F4579", + "vpcPublicSubnet1Subnet2E65531E", + "vpcA2121C38", + "vpcVPCGW7984C166" + ] + }, + "batchjobqueueE3C528F2": { + "Type": "AWS::Batch::JobQueue", + "Properties": { + "ComputeEnvironmentOrder": [ + { + "ComputeEnvironment": { + "Ref": "EFABatchEC058146" + }, + "Order": 1 + } + ], + "Priority": 1, + "State": "ENABLED" + } + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out new file mode 100644 index 0000000000000..588d7b269d34f --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out @@ -0,0 +1 @@ +{"version":"20.0.0"} \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json new file mode 100644 index 0000000000000..3becf288338f0 --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json @@ -0,0 +1,11 @@ +{ + "version": "20.0.0", + "testCases": { + "BatchWithEFATest/DefaultTest": { + "stacks": [ + "batch-stack" + ], + "assertionStack": "BatchWithEFATestDefaultTestDeployAssertDAD33663" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json new file mode 100644 index 0000000000000..16001255cab21 --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json @@ -0,0 +1,151 @@ +{ + "version": "20.0.0", + "artifacts": { + "Tree": { + "type": "cdk:tree", + "properties": { + "file": "tree.json" + } + }, + "batch-stack": { + "type": "aws:cloudformation:stack", + "environment": "aws://unknown-account/unknown-region", + "properties": { + "templateFile": "batch-stack.template.json", + "validateOnSynth": false + }, + "metadata": { + "/batch-stack/vpc/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcA2121C38" + } + ], + "/batch-stack/vpc/PublicSubnet1/Subnet": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPublicSubnet1Subnet2E65531E" + } + ], + "/batch-stack/vpc/PublicSubnet1/RouteTable": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPublicSubnet1RouteTable48A2DF9B" + } + ], + "/batch-stack/vpc/PublicSubnet1/RouteTableAssociation": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPublicSubnet1RouteTableAssociation5D3F4579" + } + ], + "/batch-stack/vpc/PublicSubnet1/DefaultRoute": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPublicSubnet1DefaultRoute10708846" + } + ], + "/batch-stack/vpc/PublicSubnet1/EIP": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPublicSubnet1EIPDA49DCBE" + } + ], + "/batch-stack/vpc/PublicSubnet1/NATGateway": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPublicSubnet1NATGateway9C16659E" + } + ], + "/batch-stack/vpc/PrivateSubnet1/Subnet": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPrivateSubnet1Subnet934893E8" + } + ], + "/batch-stack/vpc/PrivateSubnet1/RouteTable": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPrivateSubnet1RouteTableB41A48CC" + } + ], + "/batch-stack/vpc/PrivateSubnet1/RouteTableAssociation": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPrivateSubnet1RouteTableAssociation67945127" + } + ], + "/batch-stack/vpc/PrivateSubnet1/DefaultRoute": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcPrivateSubnet1DefaultRoute1AA8E2E5" + } + ], + "/batch-stack/vpc/IGW": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcIGWE57CBDCA" + } + ], + "/batch-stack/vpc/VPCGW": [ + { + "type": "aws:cdk:logicalId", + "data": "vpcVPCGW7984C166" + } + ], + "/batch-stack/EFASecurityGroup/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "EFASecurityGroupB5A52193" + } + ], + "/batch-stack/ec2-launch-template-efa": [ + { + "type": "aws:cdk:logicalId", + "data": "ec2launchtemplateefa" + } + ], + "/batch-stack/EFABatch/Ecs-Instance-Role/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "EFABatchEcsInstanceRole9A232F28" + } + ], + "/batch-stack/EFABatch/Instance-Profile": [ + { + "type": "aws:cdk:logicalId", + "data": "EFABatchInstanceProfile3450D107" + } + ], + "/batch-stack/EFABatch/Resource-Service-Instance-Role/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "EFABatchResourceServiceInstanceRoleD10C6691" + } + ], + "/batch-stack/EFABatch/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "EFABatchEC058146" + } + ], + "/batch-stack/batch-job-queue/Resource": [ + { + "type": "aws:cdk:logicalId", + "data": "batchjobqueueE3C528F2" + } + ] + }, + "displayName": "batch-stack" + }, + "BatchWithEFATestDefaultTestDeployAssertDAD33663": { + "type": "aws:cloudformation:stack", + "environment": "aws://unknown-account/unknown-region", + "properties": { + "templateFile": "BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json", + "validateOnSynth": false + }, + "displayName": "BatchWithEFATest/DefaultTest/DeployAssert" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json new file mode 100644 index 0000000000000..b36be167a1aff --- /dev/null +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json @@ -0,0 +1,704 @@ +{ + "version": "tree-0.1", + "tree": { + "id": "App", + "path": "", + "children": { + "Tree": { + "id": "Tree", + "path": "Tree", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.1.51" + } + }, + "batch-stack": { + "id": "batch-stack", + "path": "batch-stack", + "children": { + "vpc": { + "id": "vpc", + "path": "batch-stack/vpc", + "children": { + "Resource": { + "id": "Resource", + "path": "batch-stack/vpc/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::VPC", + "aws:cdk:cloudformation:props": { + "cidrBlock": "10.0.0.0/16", + "enableDnsHostnames": true, + "enableDnsSupport": true, + "instanceTenancy": "default", + "tags": [ + { + "key": "Name", + "value": "batch-stack/vpc" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnVPC", + "version": "0.0.0" + } + }, + "PublicSubnet1": { + "id": "PublicSubnet1", + "path": "batch-stack/vpc/PublicSubnet1", + "children": { + "Subnet": { + "id": "Subnet", + "path": "batch-stack/vpc/PublicSubnet1/Subnet", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::Subnet", + "aws:cdk:cloudformation:props": { + "vpcId": { + "Ref": "vpcA2121C38" + }, + "availabilityZone": { + "Fn::Select": [ + 0, + { + "Fn::GetAZs": "" + } + ] + }, + "cidrBlock": "10.0.0.0/17", + "mapPublicIpOnLaunch": true, + "tags": [ + { + "key": "aws-cdk:subnet-name", + "value": "Public" + }, + { + "key": "aws-cdk:subnet-type", + "value": "Public" + }, + { + "key": "Name", + "value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnSubnet", + "version": "0.0.0" + } + }, + "Acl": { + "id": "Acl", + "path": "batch-stack/vpc/PublicSubnet1/Acl", + "constructInfo": { + "fqn": "@aws-cdk/core.Resource", + "version": "0.0.0" + } + }, + "RouteTable": { + "id": "RouteTable", + "path": "batch-stack/vpc/PublicSubnet1/RouteTable", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable", + "aws:cdk:cloudformation:props": { + "vpcId": { + "Ref": "vpcA2121C38" + }, + "tags": [ + { + "key": "Name", + "value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnRouteTable", + "version": "0.0.0" + } + }, + "RouteTableAssociation": { + "id": "RouteTableAssociation", + "path": "batch-stack/vpc/PublicSubnet1/RouteTableAssociation", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation", + "aws:cdk:cloudformation:props": { + "routeTableId": { + "Ref": "vpcPublicSubnet1RouteTable48A2DF9B" + }, + "subnetId": { + "Ref": "vpcPublicSubnet1Subnet2E65531E" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnSubnetRouteTableAssociation", + "version": "0.0.0" + } + }, + "DefaultRoute": { + "id": "DefaultRoute", + "path": "batch-stack/vpc/PublicSubnet1/DefaultRoute", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::Route", + "aws:cdk:cloudformation:props": { + "routeTableId": { + "Ref": "vpcPublicSubnet1RouteTable48A2DF9B" + }, + "destinationCidrBlock": "0.0.0.0/0", + "gatewayId": { + "Ref": "vpcIGWE57CBDCA" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnRoute", + "version": "0.0.0" + } + }, + "EIP": { + "id": "EIP", + "path": "batch-stack/vpc/PublicSubnet1/EIP", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::EIP", + "aws:cdk:cloudformation:props": { + "domain": "vpc", + "tags": [ + { + "key": "Name", + "value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnEIP", + "version": "0.0.0" + } + }, + "NATGateway": { + "id": "NATGateway", + "path": "batch-stack/vpc/PublicSubnet1/NATGateway", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::NatGateway", + "aws:cdk:cloudformation:props": { + "subnetId": { + "Ref": "vpcPublicSubnet1Subnet2E65531E" + }, + "allocationId": { + "Fn::GetAtt": [ + "vpcPublicSubnet1EIPDA49DCBE", + "AllocationId" + ] + }, + "tags": [ + { + "key": "Name", + "value": "batch-stack/vpc/PublicSubnet1" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnNatGateway", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.PublicSubnet", + "version": "0.0.0" + } + }, + "PrivateSubnet1": { + "id": "PrivateSubnet1", + "path": "batch-stack/vpc/PrivateSubnet1", + "children": { + "Subnet": { + "id": "Subnet", + "path": "batch-stack/vpc/PrivateSubnet1/Subnet", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::Subnet", + "aws:cdk:cloudformation:props": { + "vpcId": { + "Ref": "vpcA2121C38" + }, + "availabilityZone": { + "Fn::Select": [ + 0, + { + "Fn::GetAZs": "" + } + ] + }, + "cidrBlock": "10.0.128.0/17", + "mapPublicIpOnLaunch": false, + "tags": [ + { + "key": "aws-cdk:subnet-name", + "value": "Private" + }, + { + "key": "aws-cdk:subnet-type", + "value": "Private" + }, + { + "key": "Name", + "value": "batch-stack/vpc/PrivateSubnet1" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnSubnet", + "version": "0.0.0" + } + }, + "Acl": { + "id": "Acl", + "path": "batch-stack/vpc/PrivateSubnet1/Acl", + "constructInfo": { + "fqn": "@aws-cdk/core.Resource", + "version": "0.0.0" + } + }, + "RouteTable": { + "id": "RouteTable", + "path": "batch-stack/vpc/PrivateSubnet1/RouteTable", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable", + "aws:cdk:cloudformation:props": { + "vpcId": { + "Ref": "vpcA2121C38" + }, + "tags": [ + { + "key": "Name", + "value": "batch-stack/vpc/PrivateSubnet1" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnRouteTable", + "version": "0.0.0" + } + }, + "RouteTableAssociation": { + "id": "RouteTableAssociation", + "path": "batch-stack/vpc/PrivateSubnet1/RouteTableAssociation", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation", + "aws:cdk:cloudformation:props": { + "routeTableId": { + "Ref": "vpcPrivateSubnet1RouteTableB41A48CC" + }, + "subnetId": { + "Ref": "vpcPrivateSubnet1Subnet934893E8" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnSubnetRouteTableAssociation", + "version": "0.0.0" + } + }, + "DefaultRoute": { + "id": "DefaultRoute", + "path": "batch-stack/vpc/PrivateSubnet1/DefaultRoute", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::Route", + "aws:cdk:cloudformation:props": { + "routeTableId": { + "Ref": "vpcPrivateSubnet1RouteTableB41A48CC" + }, + "destinationCidrBlock": "0.0.0.0/0", + "natGatewayId": { + "Ref": "vpcPublicSubnet1NATGateway9C16659E" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnRoute", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.PrivateSubnet", + "version": "0.0.0" + } + }, + "IGW": { + "id": "IGW", + "path": "batch-stack/vpc/IGW", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::InternetGateway", + "aws:cdk:cloudformation:props": { + "tags": [ + { + "key": "Name", + "value": "batch-stack/vpc" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnInternetGateway", + "version": "0.0.0" + } + }, + "VPCGW": { + "id": "VPCGW", + "path": "batch-stack/vpc/VPCGW", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::VPCGatewayAttachment", + "aws:cdk:cloudformation:props": { + "vpcId": { + "Ref": "vpcA2121C38" + }, + "internetGatewayId": { + "Ref": "vpcIGWE57CBDCA" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnVPCGatewayAttachment", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.Vpc", + "version": "0.0.0" + } + }, + "EFASecurityGroup": { + "id": "EFASecurityGroup", + "path": "batch-stack/EFASecurityGroup", + "children": { + "Resource": { + "id": "Resource", + "path": "batch-stack/EFASecurityGroup/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::SecurityGroup", + "aws:cdk:cloudformation:props": { + "groupDescription": "batch-stack/EFASecurityGroup", + "securityGroupEgress": [ + { + "cidrIp": "0.0.0.0/0", + "description": "Allow all outbound traffic by default", + "ipProtocol": "-1" + } + ], + "vpcId": { + "Ref": "vpcA2121C38" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnSecurityGroup", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.SecurityGroup", + "version": "0.0.0" + } + }, + "ec2-launch-template-efa": { + "id": "ec2-launch-template-efa", + "path": "batch-stack/ec2-launch-template-efa", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::EC2::LaunchTemplate", + "aws:cdk:cloudformation:props": { + "launchTemplateData": { + "networkInterfaces": [ + { + "deviceIndex": 0, + "subnetId": { + "Ref": "vpcPrivateSubnet1Subnet934893E8" + }, + "interfaceType": "efa", + "groups": [ + { + "Fn::GetAtt": [ + "EFASecurityGroupB5A52193", + "GroupId" + ] + } + ] + } + ] + }, + "launchTemplateName": "EC2LaunchTemplateEFA" + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-ec2.CfnLaunchTemplate", + "version": "0.0.0" + } + }, + "EFABatch": { + "id": "EFABatch", + "path": "batch-stack/EFABatch", + "children": { + "Ecs-Instance-Role": { + "id": "Ecs-Instance-Role", + "path": "batch-stack/EFABatch/Ecs-Instance-Role", + "children": { + "Resource": { + "id": "Resource", + "path": "batch-stack/EFABatch/Ecs-Instance-Role/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": { + "Fn::Join": [ + "", + [ + "ec2.", + { + "Ref": "AWS::URLSuffix" + } + ] + ] + } + } + } + ], + "Version": "2012-10-17" + }, + "managedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role" + ] + ] + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-iam.CfnRole", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-iam.Role", + "version": "0.0.0" + } + }, + "Instance-Profile": { + "id": "Instance-Profile", + "path": "batch-stack/EFABatch/Instance-Profile", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::InstanceProfile", + "aws:cdk:cloudformation:props": { + "roles": [ + { + "Ref": "EFABatchEcsInstanceRole9A232F28" + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-iam.CfnInstanceProfile", + "version": "0.0.0" + } + }, + "Resource-Service-Instance-Role": { + "id": "Resource-Service-Instance-Role", + "path": "batch-stack/EFABatch/Resource-Service-Instance-Role", + "children": { + "Resource": { + "id": "Resource", + "path": "batch-stack/EFABatch/Resource-Service-Instance-Role/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::IAM::Role", + "aws:cdk:cloudformation:props": { + "assumeRolePolicyDocument": { + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "batch.amazonaws.com" + } + } + ], + "Version": "2012-10-17" + }, + "managedPolicyArns": [ + { + "Fn::Join": [ + "", + [ + "arn:", + { + "Ref": "AWS::Partition" + }, + ":iam::aws:policy/service-role/AWSBatchServiceRole" + ] + ] + } + ] + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-iam.CfnRole", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-iam.Role", + "version": "0.0.0" + } + }, + "Resource": { + "id": "Resource", + "path": "batch-stack/EFABatch/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Batch::ComputeEnvironment", + "aws:cdk:cloudformation:props": { + "type": "MANAGED", + "computeResources": { + "launchTemplate": { + "launchTemplateName": "EC2LaunchTemplateEFA" + }, + "maxvCpus": 256, + "subnets": [ + { + "Ref": "vpcPrivateSubnet1Subnet934893E8" + } + ], + "type": "EC2", + "allocationStrategy": "BEST_FIT", + "instanceRole": { + "Fn::GetAtt": [ + "EFABatchInstanceProfile3450D107", + "Arn" + ] + }, + "instanceTypes": [ + "c5n.18xlarge" + ], + "minvCpus": 0 + }, + "serviceRole": { + "Fn::GetAtt": [ + "EFABatchResourceServiceInstanceRoleD10C6691", + "Arn" + ] + }, + "state": "ENABLED" + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-batch.CfnComputeEnvironment", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-batch.ComputeEnvironment", + "version": "0.0.0" + } + }, + "batch-job-queue": { + "id": "batch-job-queue", + "path": "batch-stack/batch-job-queue", + "children": { + "Resource": { + "id": "Resource", + "path": "batch-stack/batch-job-queue/Resource", + "attributes": { + "aws:cdk:cloudformation:type": "AWS::Batch::JobQueue", + "aws:cdk:cloudformation:props": { + "computeEnvironmentOrder": [ + { + "computeEnvironment": { + "Ref": "EFABatchEC058146" + }, + "order": 1 + } + ], + "priority": 1, + "state": "ENABLED" + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-batch.CfnJobQueue", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/aws-batch.JobQueue", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/core.Stack", + "version": "0.0.0" + } + }, + "BatchWithEFATest": { + "id": "BatchWithEFATest", + "path": "BatchWithEFATest", + "children": { + "DefaultTest": { + "id": "DefaultTest", + "path": "BatchWithEFATest/DefaultTest", + "children": { + "Default": { + "id": "Default", + "path": "BatchWithEFATest/DefaultTest/Default", + "constructInfo": { + "fqn": "constructs.Construct", + "version": "10.1.51" + } + }, + "DeployAssert": { + "id": "DeployAssert", + "path": "BatchWithEFATest/DefaultTest/DeployAssert", + "constructInfo": { + "fqn": "@aws-cdk/core.Stack", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/integ-tests.IntegTestCase", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/integ-tests.IntegTest", + "version": "0.0.0" + } + } + }, + "constructInfo": { + "fqn": "@aws-cdk/core.App", + "version": "0.0.0" + } + } +} \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts index d31a0f60e9a82..8dc0de43da678 100644 --- a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts +++ b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts @@ -1,5 +1,5 @@ import { throws } from 'assert'; -import { Template } from '@aws-cdk/assertions'; +import { Template, Match } from '@aws-cdk/assertions'; import * as ec2 from '@aws-cdk/aws-ec2'; import * as ecs from '@aws-cdk/aws-ecs'; import * as iam from '@aws-cdk/aws-iam'; @@ -584,6 +584,57 @@ describe('Batch Compute Environment', () => { }); }); + describe('with automatic securityGroups', () => { + test('should have SecurityGroupIds', () => { + // WHEN + new batch.ComputeEnvironment(stack, 'test-compute-env', { + managed: true, + computeResources: { + vpc, + securityGroups: batch.ComputeEnvironmentSecurityGroups.AUTOMATIC, + }, + }); + + // THEN + Template.fromStack(stack).hasResourceProperties( + 'AWS::Batch::ComputeEnvironment', { + ComputeResources: { + SecurityGroupIds: [ + { + 'Fn::GetAtt': [ + 'testcomputeenvResourceSecurityGroup7615BA87', + 'GroupId', + ], + }, + ], + }, + }, + ); + }); + }); + + describe('without securityGroups', () => { + test('should not have a SecurityGroupIds', () => { + // WHEN + new batch.ComputeEnvironment(stack, 'efa-compute-env', { + managed: true, + computeResources: { + vpc, + securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, + }, + }); + + // THEN + Template.fromStack(stack).hasResourceProperties( + 'AWS::Batch::ComputeEnvironment', { + ComputeResources: { + SecurityGroupIds: Match.absent(), + }, + }, + ); + }); + }); + describe('connectable functions', () => { test('ec2 ingress rule', () => { const computeEnvironment = new batch.ComputeEnvironment(stack, 'test-compute-env', { diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts index 232147c6eb1bf..8722e05a78c6e 100644 --- a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -7,7 +7,11 @@ export const app = new cdk.App(); const stack = new cdk.Stack(app, 'batch-stack'); -const vpc = new ec2.Vpc(stack, 'vpc'); +const vpc = new ec2.Vpc(stack, 'vpc', { maxAzs: 1 }); + +const efaSecurityGroup = new ec2.SecurityGroup(stack, 'EFASecurityGroup', { + vpc, +}); // While this test specifies EFA, the same behavior occurs with // interfaceType: 'interface' as well @@ -18,6 +22,7 @@ const launchTemplateEFA = new ec2.CfnLaunchTemplate(stack, 'ec2-launch-template- deviceIndex: 0, subnetId: vpc.privateSubnets[0].subnetId, interfaceType: 'efa', + groups: [efaSecurityGroup.securityGroupId], }], }, }); @@ -26,7 +31,10 @@ const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFABatch', { managed: true, computeResources: { type: batch.ComputeResourceType.ON_DEMAND, - instanceTypes: [new ec2.InstanceType('c5n')], + instanceTypes: [new ec2.InstanceType('c5n.18xlarge')], + // Security Groups explicitly set empty because they are in the + // launch template + securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, vpc, launchTemplate: { launchTemplateName: launchTemplateEFA.launchTemplateName as string, From 8a9dbf52a9ff3525bc204a73606fbe3310b1190e Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Fri, 12 Aug 2022 12:39:03 +0100 Subject: [PATCH 05/13] doc: Network interfaces in launch templates --- packages/@aws-cdk/aws-batch/README.md | 36 +++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/packages/@aws-cdk/aws-batch/README.md b/packages/@aws-cdk/aws-batch/README.md index 8c06ad6e7b623..e760ae7c67708 100644 --- a/packages/@aws-cdk/aws-batch/README.md +++ b/packages/@aws-cdk/aws-batch/README.md @@ -187,6 +187,42 @@ const myComputeEnv = new batch.ComputeEnvironment(this, 'ComputeEnv', { }); ``` +Note that if your launch template explicitly specifies network interfaces, +for example to use an Elastic Fabric Adapter, you must explicitly tell CDK not to +auto-create security groups in the `ComputeEnvironment` construct. Instead, you must +define them in the Launch Template. For example: + +```ts +declare const vpc: ec2.Vpc; + +const efaSecurityGroup = new ec2.SecurityGroup(stack, 'EFASecurityGroup', { + vpc, +}); + +const launchTemplateEFA = new ec2.CfnLaunchTemplate(stack, 'LaunchTemplate', { + launchTemplateName: 'LaunchTemplateName', + launchTemplateData: { + networkInterfaces: [{ + deviceIndex: 0, + subnetId: vpc.privateSubnets[0].subnetId, + interfaceType: 'efa', + groups: [efaSecurityGroup.securityGroupId], + }], + }, +}); + +const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFAComputeEnv', { + managed: true, + computeResources: { + securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, + vpc, + launchTemplate: { + launchTemplateName: launchTemplateEFA.launchTemplateName as string, + }, + }, +}); +``` + ### Importing an existing Compute Environment To import an existing batch compute environment, call `ComputeEnvironment.fromComputeEnvironmentArn()`. From 6eb2196320cad2fc189c0bd50bb4098386ee8421 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Fri, 12 Aug 2022 12:58:23 +0100 Subject: [PATCH 06/13] bug: == vs === --- packages/@aws-cdk/aws-batch/lib/compute-environment.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index 7995e4fe85501..68ea1d304f299 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -610,7 +610,7 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, } if (securityGroups === undefined || - securityGroups == ComputeEnvironmentSecurityGroups.AUTOMATIC) { + securityGroups === ComputeEnvironmentSecurityGroups.AUTOMATIC) { return new ec2.Connections({ securityGroups: [ new ec2.SecurityGroup(this, 'Resource-Security-Group', { vpc }), From 0a404626b2a10682fc9b83a458bc88f37c53e6fb Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Fri, 12 Aug 2022 13:49:51 +0100 Subject: [PATCH 07/13] fix: Documentation example not correct --- packages/@aws-cdk/aws-batch/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/README.md b/packages/@aws-cdk/aws-batch/README.md index e760ae7c67708..7f6b958598611 100644 --- a/packages/@aws-cdk/aws-batch/README.md +++ b/packages/@aws-cdk/aws-batch/README.md @@ -195,11 +195,11 @@ define them in the Launch Template. For example: ```ts declare const vpc: ec2.Vpc; -const efaSecurityGroup = new ec2.SecurityGroup(stack, 'EFASecurityGroup', { +const efaSecurityGroup = new ec2.SecurityGroup(this, 'EFASecurityGroup', { vpc, }); -const launchTemplateEFA = new ec2.CfnLaunchTemplate(stack, 'LaunchTemplate', { +const launchTemplateEFA = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', { launchTemplateName: 'LaunchTemplateName', launchTemplateData: { networkInterfaces: [{ @@ -211,7 +211,7 @@ const launchTemplateEFA = new ec2.CfnLaunchTemplate(stack, 'LaunchTemplate', { }, }); -const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFAComputeEnv', { +const computeEnvironmentEFA = new batch.ComputeEnvironment(this, 'EFAComputeEnv', { managed: true, computeResources: { securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, From 56ac6b1255a259d6f348e9f7de2a283b97c8e047 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Tue, 16 Aug 2022 14:54:12 +0100 Subject: [PATCH 08/13] Cannot use a union type, so removed ComputeEnvironmentSecurityGroups in favour of empty list --- packages/@aws-cdk/aws-batch/README.md | 5 ++- .../aws-batch/lib/compute-environment.ts | 37 +++++-------------- .../test/compute-environment.test.ts | 31 +--------------- .../aws-batch/test/integ.batch-with-efa.ts | 2 +- 4 files changed, 14 insertions(+), 61 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/README.md b/packages/@aws-cdk/aws-batch/README.md index 7f6b958598611..33f0ad6c6def5 100644 --- a/packages/@aws-cdk/aws-batch/README.md +++ b/packages/@aws-cdk/aws-batch/README.md @@ -190,7 +190,8 @@ const myComputeEnv = new batch.ComputeEnvironment(this, 'ComputeEnv', { Note that if your launch template explicitly specifies network interfaces, for example to use an Elastic Fabric Adapter, you must explicitly tell CDK not to auto-create security groups in the `ComputeEnvironment` construct. Instead, you must -define them in the Launch Template. For example: +define them in the Launch Template, and specify an empty list of security groups in +the `ComputeEnvironment`. For example: ```ts declare const vpc: ec2.Vpc; @@ -214,7 +215,7 @@ const launchTemplateEFA = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', { const computeEnvironmentEFA = new batch.ComputeEnvironment(this, 'EFAComputeEnv', { managed: true, computeResources: { - securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, + securityGroups: [], vpc, launchTemplate: { launchTemplateName: launchTemplateEFA.launchTemplateName as string, diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index 68ea1d304f299..0008a66ba9cc3 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -33,25 +33,6 @@ export enum ComputeResourceType { */ FARGATE_SPOT = 'FARGATE_SPOT', } -/** - * Flag to determine whether or not the ComputeEnvironment should - * autocreate Security Groups. - */ -export enum ComputeEnvironmentSecurityGroups { - /** - * The Compute Environment will not create any security groups - * - * This is needed if you are instead assigning security groups - * to network interfaces defined in a launch template - */ - NONE = 'NONE', - /** - * The Compute Environment will create security groups if none - * are explicity specified - * to network interfaces defined in a launch template - */ - AUTOMATIC = 'AUTOMATIC', -} /** * Properties for how to prepare compute resources @@ -159,9 +140,15 @@ export interface ComputeResources { /** * The EC2 security group(s) associated with instances launched in the compute environment. * + * If this is set to the empty list, no SecurityGroupIds will be emitted. + * You are unlikely to want to do this unless you need to specify security + * groups elsewhere (such as in a launch template network interface) + * + * If it is undefined, a default security group will be created + * * @default - AWS default security group. */ - readonly securityGroups?: ec2.ISecurityGroup[] | ComputeEnvironmentSecurityGroups; + readonly securityGroups?: ec2.ISecurityGroup[]; /** * The VPC network that all compute resources will be connected to. @@ -603,25 +590,19 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, return instanceTypes.map((type: ec2.InstanceType) => type.toString()); } - private buildConnections(vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[] | ComputeEnvironmentSecurityGroups ): ec2.Connections { + private buildConnections(vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[]): ec2.Connections { if (vpc === undefined) { return new ec2.Connections({}); } - if (securityGroups === undefined || - securityGroups === ComputeEnvironmentSecurityGroups.AUTOMATIC) { + if (securityGroups === undefined) { return new ec2.Connections({ securityGroups: [ new ec2.SecurityGroup(this, 'Resource-Security-Group', { vpc }), ], }); } - - if (securityGroups === ComputeEnvironmentSecurityGroups.NONE) { - return new ec2.Connections({}); - } - return new ec2.Connections({ securityGroups }); }; diff --git a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts index 8dc0de43da678..8c845e5bc30c5 100644 --- a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts +++ b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts @@ -584,35 +584,6 @@ describe('Batch Compute Environment', () => { }); }); - describe('with automatic securityGroups', () => { - test('should have SecurityGroupIds', () => { - // WHEN - new batch.ComputeEnvironment(stack, 'test-compute-env', { - managed: true, - computeResources: { - vpc, - securityGroups: batch.ComputeEnvironmentSecurityGroups.AUTOMATIC, - }, - }); - - // THEN - Template.fromStack(stack).hasResourceProperties( - 'AWS::Batch::ComputeEnvironment', { - ComputeResources: { - SecurityGroupIds: [ - { - 'Fn::GetAtt': [ - 'testcomputeenvResourceSecurityGroup7615BA87', - 'GroupId', - ], - }, - ], - }, - }, - ); - }); - }); - describe('without securityGroups', () => { test('should not have a SecurityGroupIds', () => { // WHEN @@ -620,7 +591,7 @@ describe('Batch Compute Environment', () => { managed: true, computeResources: { vpc, - securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, + securityGroups: [], }, }); diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts index 8722e05a78c6e..815536cea69a4 100644 --- a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -34,7 +34,7 @@ const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFABatch', { instanceTypes: [new ec2.InstanceType('c5n.18xlarge')], // Security Groups explicitly set empty because they are in the // launch template - securityGroups: batch.ComputeEnvironmentSecurityGroups.NONE, + securityGroups: [], vpc, launchTemplate: { launchTemplateName: launchTemplateEFA.launchTemplateName as string, From 3e9c4c37b8d151c75f927af1fc1cb7c55d7b7705 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Wed, 17 Aug 2022 14:35:32 +0100 Subject: [PATCH 09/13] Explicit flag to use security groups from launch template network interfaces --- packages/@aws-cdk/aws-batch/README.md | 5 +- .../aws-batch/lib/compute-environment.ts | 52 ++++++++++++++----- .../test/compute-environment.test.ts | 39 ++++++++++++-- .../aws-batch/test/integ.batch-with-efa.ts | 4 +- 4 files changed, 78 insertions(+), 22 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/README.md b/packages/@aws-cdk/aws-batch/README.md index 33f0ad6c6def5..80c3cc6e20e54 100644 --- a/packages/@aws-cdk/aws-batch/README.md +++ b/packages/@aws-cdk/aws-batch/README.md @@ -190,8 +190,7 @@ const myComputeEnv = new batch.ComputeEnvironment(this, 'ComputeEnv', { Note that if your launch template explicitly specifies network interfaces, for example to use an Elastic Fabric Adapter, you must explicitly tell CDK not to auto-create security groups in the `ComputeEnvironment` construct. Instead, you must -define them in the Launch Template, and specify an empty list of security groups in -the `ComputeEnvironment`. For example: +define them in the Launch Template, and set `useLaunchTemplateNetworkInterface`. For example: ```ts declare const vpc: ec2.Vpc; @@ -215,7 +214,7 @@ const launchTemplateEFA = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', { const computeEnvironmentEFA = new batch.ComputeEnvironment(this, 'EFAComputeEnv', { managed: true, computeResources: { - securityGroups: [], + useLaunchTemplateNetworkInterface: true, vpc, launchTemplate: { launchTemplateName: launchTemplateEFA.launchTemplateName as string, diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index 0008a66ba9cc3..e3fde0972f8a3 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -127,6 +127,17 @@ export interface ComputeResources { */ readonly launchTemplate?: LaunchTemplateSpecification; + /** + * Use security groups defined in the launch template network interfaces + * + * In some cases, such as specifying Elastic Fabric Adapters, network + * network interfaces must be used to specify security groups. This + * parameter is mutually exclusive with securityGroups + * + * @default - false + */ + readonly useLaunchTemplateNetworkInterface?: boolean; + /** * The types of EC2 instances that may be launched in the compute environment. You can specify instance * families to launch any instance type within those families (for example, c4 or p3), or you can specify @@ -138,15 +149,11 @@ export interface ComputeResources { readonly instanceTypes?: ec2.InstanceType[]; /** - * The EC2 security group(s) associated with instances launched in the compute environment. - * - * If this is set to the empty list, no SecurityGroupIds will be emitted. - * You are unlikely to want to do this unless you need to specify security - * groups elsewhere (such as in a launch template network interface) + * Up to 5 EC2 security group(s) associated with instances launched in the compute environment. * - * If it is undefined, a default security group will be created + * This parameter is mutually exclusive with useLaunchTemplateInterface * - * @default - AWS default security group. + * @default - Create a single default security group. */ readonly securityGroups?: ec2.ISecurityGroup[]; @@ -381,7 +388,9 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, const spotFleetRole = this.getSpotFleetRole(props); let computeResources: CfnComputeEnvironment.ComputeResourcesProperty | undefined; - this.connections = this.buildConnections(props.computeResources?.vpc, props.computeResources?.securityGroups); + const useLaunchTemplateNetworkInterface = props.computeResources?.useLaunchTemplateNetworkInterface ? true : false; + + this.connections = this.buildConnections(useLaunchTemplateNetworkInterface, props.computeResources?.vpc, props.computeResources?.securityGroups); // Only allow compute resources to be set when using MANAGED type if (props.computeResources && this.isManaged(props)) { @@ -394,7 +403,7 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, launchTemplate: props.computeResources.launchTemplate, maxvCpus: props.computeResources.maxvCpus || 256, placementGroup: props.computeResources.placementGroup, - securityGroupIds: this.getSecurityGroupIds(), + securityGroupIds: this.getSecurityGroupIds(useLaunchTemplateNetworkInterface), spotIamFleetRole: spotFleetRole?.roleArn, subnets: props.computeResources.vpc.selectSubnets(props.computeResources.vpcSubnets).subnetIds, tags: props.computeResources.computeResourcesTags, @@ -526,6 +535,11 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, if (props.computeResources.spotFleetRole !== undefined) { throw new Error('Spot fleet role must not be set for Fargate compute environments'); } + + // useNetworkInterfaces cannot be specified for Fargate + if (props.computeResources.useLaunchTemplateNetworkInterface !== undefined) { + throw new Error('LaunchTemplate network interfaces must not be set for Fargate compute environments'); + } } else { // VALIDATE FOR ON_DEMAND AND SPOT if (props.computeResources.minvCpus) { @@ -553,6 +567,18 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, throw new Error('You must specify either the launch template ID or launch template name in the request.'); } + //useLaunchTemplateNetworkInterface requires a launch template + if (props.computeResources.useLaunchTemplateNetworkInterface && + !props.computeResources.launchTemplate ) { + throw new Error('useLaunchTemplateNetworkInterfaces requires launchTemplate to be specified'); + } + + // useLaunchTemplateNetworkInteface cannot have securityGroups defined + if (props.computeResources.useLaunchTemplateNetworkInterface && + props.computeResources.securityGroups ) { + throw new Error('securityGroups cannot be specified if useLaunchTemplateNetworkInterfaces is true'); + } + // Setting a bid percentage is only allowed on SPOT resources + // Cannot use SPOT_CAPACITY_OPTIMIZED when using ON_DEMAND if (props.computeResources.type === ComputeResourceType.ON_DEMAND) { @@ -590,9 +616,9 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, return instanceTypes.map((type: ec2.InstanceType) => type.toString()); } - private buildConnections(vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[]): ec2.Connections { + private buildConnections(useLaunchTemplateNetworkInterface: boolean, vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[]): ec2.Connections { - if (vpc === undefined) { + if (vpc === undefined || useLaunchTemplateNetworkInterface ) { return new ec2.Connections({}); } @@ -606,9 +632,9 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, return new ec2.Connections({ securityGroups }); }; - private getSecurityGroupIds(): string[] | undefined { + private getSecurityGroupIds(useLaunchTemplateInterface: boolean): string[] | undefined { if (this.connections === undefined || - this.connections.securityGroups.length < 1) { + useLaunchTemplateInterface ) { return undefined; } diff --git a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts index 8c845e5bc30c5..982e1042fd1af 100644 --- a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts +++ b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts @@ -584,14 +584,47 @@ describe('Batch Compute Environment', () => { }); }); - describe('without securityGroups', () => { - test('should not have a SecurityGroupIds', () => { + describe('without useLaunchTemplateNetworkInterface', () => { + test('should not have securityGroups', () => { + // THEN + throws(() => { + // WHEN + new batch.ComputeEnvironment(stack, 'test-compute-env', { + managed: true, + computeResources: { + vpc, + useLaunchTemplateNetworkInterface: true, + launchTemplate: { + launchTemplateName: 'dummyname', + }, + securityGroups: [], + }, + }); + }); + }); + test('should have a launch template', () => { + // THEN + throws(() => { + // WHEN + new batch.ComputeEnvironment(stack, 'test-compute-env', { + managed: true, + computeResources: { + vpc, + useLaunchTemplateNetworkInterface: true, + }, + }); + }); + }); + test('should not have a SecurityGroupIds output', () => { // WHEN new batch.ComputeEnvironment(stack, 'efa-compute-env', { managed: true, computeResources: { vpc, - securityGroups: [], + useLaunchTemplateNetworkInterface: true, + launchTemplate: { + launchTemplateName: 'dummyname', + }, }, }); diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts index 815536cea69a4..30be1514637a7 100644 --- a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -32,9 +32,7 @@ const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFABatch', { computeResources: { type: batch.ComputeResourceType.ON_DEMAND, instanceTypes: [new ec2.InstanceType('c5n.18xlarge')], - // Security Groups explicitly set empty because they are in the - // launch template - securityGroups: [], + useLaunchTemplateNetworkInterface: true, vpc, launchTemplate: { launchTemplateName: launchTemplateEFA.launchTemplateName as string, From 428073cb6cce259173c8735ed1b9fe1d3bc39be8 Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Thu, 18 Aug 2022 14:36:58 +0100 Subject: [PATCH 10/13] Moved network interface security group flag into the LaunchTemplateSpecification --- packages/@aws-cdk/aws-batch/README.md | 9 +++-- .../aws-batch/lib/compute-environment.ts | 40 +++++++------------ .../test/compute-environment.test.ts | 18 ++------- .../aws-batch/test/integ.batch-with-efa.ts | 2 +- 4 files changed, 24 insertions(+), 45 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/README.md b/packages/@aws-cdk/aws-batch/README.md index 80c3cc6e20e54..082e29af446e6 100644 --- a/packages/@aws-cdk/aws-batch/README.md +++ b/packages/@aws-cdk/aws-batch/README.md @@ -188,9 +188,10 @@ const myComputeEnv = new batch.ComputeEnvironment(this, 'ComputeEnv', { ``` Note that if your launch template explicitly specifies network interfaces, -for example to use an Elastic Fabric Adapter, you must explicitly tell CDK not to -auto-create security groups in the `ComputeEnvironment` construct. Instead, you must -define them in the Launch Template, and set `useLaunchTemplateNetworkInterface`. For example: +for example to use an Elastic Fabric Adapter, you must use those security groups rather +than allow the `ComputeEnvironment` to define them. This is done by setting +`useNetworkInterfaceSecurityGroups` in the launch template property of the environment. +For example: ```ts declare const vpc: ec2.Vpc; @@ -214,10 +215,10 @@ const launchTemplateEFA = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', { const computeEnvironmentEFA = new batch.ComputeEnvironment(this, 'EFAComputeEnv', { managed: true, computeResources: { - useLaunchTemplateNetworkInterface: true, vpc, launchTemplate: { launchTemplateName: launchTemplateEFA.launchTemplateName as string, + useNetworkInterfaceSecurityGroups: true, }, }, }); diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index e3fde0972f8a3..e98dec9b3108b 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -83,6 +83,17 @@ export interface LaunchTemplateSpecification { * @default - the default version of the launch template */ readonly version?: string; + /** + * Use security groups defined in the launch template network interfaces + * + * In some cases, such as specifying Elastic Fabric Adapters, network + * network interfaces must be used to specify security groups. This + * parameter is mutually exclusive with securityGroups in the Compute + * Environment + * + * @default - false + */ + readonly useNetworkInterfaceSecurityGroups?: boolean; } /** @@ -127,17 +138,6 @@ export interface ComputeResources { */ readonly launchTemplate?: LaunchTemplateSpecification; - /** - * Use security groups defined in the launch template network interfaces - * - * In some cases, such as specifying Elastic Fabric Adapters, network - * network interfaces must be used to specify security groups. This - * parameter is mutually exclusive with securityGroups - * - * @default - false - */ - readonly useLaunchTemplateNetworkInterface?: boolean; - /** * The types of EC2 instances that may be launched in the compute environment. You can specify instance * families to launch any instance type within those families (for example, c4 or p3), or you can specify @@ -151,7 +151,7 @@ export interface ComputeResources { /** * Up to 5 EC2 security group(s) associated with instances launched in the compute environment. * - * This parameter is mutually exclusive with useLaunchTemplateInterface + * This parameter is mutually exclusive with launchTemplate.useNetworkInterfaceSecurityGroups * * @default - Create a single default security group. */ @@ -388,7 +388,7 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, const spotFleetRole = this.getSpotFleetRole(props); let computeResources: CfnComputeEnvironment.ComputeResourcesProperty | undefined; - const useLaunchTemplateNetworkInterface = props.computeResources?.useLaunchTemplateNetworkInterface ? true : false; + const useLaunchTemplateNetworkInterface = props.computeResources?.launchTemplate?.useNetworkInterfaceSecurityGroups ? true : false; this.connections = this.buildConnections(useLaunchTemplateNetworkInterface, props.computeResources?.vpc, props.computeResources?.securityGroups); @@ -536,10 +536,6 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, throw new Error('Spot fleet role must not be set for Fargate compute environments'); } - // useNetworkInterfaces cannot be specified for Fargate - if (props.computeResources.useLaunchTemplateNetworkInterface !== undefined) { - throw new Error('LaunchTemplate network interfaces must not be set for Fargate compute environments'); - } } else { // VALIDATE FOR ON_DEMAND AND SPOT if (props.computeResources.minvCpus) { @@ -567,16 +563,10 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, throw new Error('You must specify either the launch template ID or launch template name in the request.'); } - //useLaunchTemplateNetworkInterface requires a launch template - if (props.computeResources.useLaunchTemplateNetworkInterface && - !props.computeResources.launchTemplate ) { - throw new Error('useLaunchTemplateNetworkInterfaces requires launchTemplate to be specified'); - } - // useLaunchTemplateNetworkInteface cannot have securityGroups defined - if (props.computeResources.useLaunchTemplateNetworkInterface && + if (props.computeResources.launchTemplate?.useNetworkInterfaceSecurityGroups && props.computeResources.securityGroups ) { - throw new Error('securityGroups cannot be specified if useLaunchTemplateNetworkInterfaces is true'); + throw new Error('securityGroups cannot be specified if launchTemplate useNetworkInterfaceSecurityGroups is active'); } // Setting a bid percentage is only allowed on SPOT resources + diff --git a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts index 982e1042fd1af..3927a51ad80a5 100644 --- a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts +++ b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts @@ -593,8 +593,8 @@ describe('Batch Compute Environment', () => { managed: true, computeResources: { vpc, - useLaunchTemplateNetworkInterface: true, launchTemplate: { + useNetworkInterfaceSecurityGroups: true, launchTemplateName: 'dummyname', }, securityGroups: [], @@ -602,27 +602,15 @@ describe('Batch Compute Environment', () => { }); }); }); - test('should have a launch template', () => { - // THEN - throws(() => { - // WHEN - new batch.ComputeEnvironment(stack, 'test-compute-env', { - managed: true, - computeResources: { - vpc, - useLaunchTemplateNetworkInterface: true, - }, - }); - }); - }); + test('should not have a SecurityGroupIds output', () => { // WHEN new batch.ComputeEnvironment(stack, 'efa-compute-env', { managed: true, computeResources: { vpc, - useLaunchTemplateNetworkInterface: true, launchTemplate: { + useNetworkInterfaceSecurityGroups: true, launchTemplateName: 'dummyname', }, }, diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts index 30be1514637a7..63c1d84f3be42 100644 --- a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts +++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts @@ -32,9 +32,9 @@ const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFABatch', { computeResources: { type: batch.ComputeResourceType.ON_DEMAND, instanceTypes: [new ec2.InstanceType('c5n.18xlarge')], - useLaunchTemplateNetworkInterface: true, vpc, launchTemplate: { + useNetworkInterfaceSecurityGroups: true, launchTemplateName: launchTemplateEFA.launchTemplateName as string, }, }, From 56f9bc5976ce86bff16ba37abfd4dc2080f3c24b Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Thu, 18 Aug 2022 14:45:29 +0100 Subject: [PATCH 11/13] doc: removed typo and clarified behaviour --- packages/@aws-cdk/aws-batch/lib/compute-environment.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index e98dec9b3108b..bac94669dbf61 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -86,8 +86,10 @@ export interface LaunchTemplateSpecification { /** * Use security groups defined in the launch template network interfaces * - * In some cases, such as specifying Elastic Fabric Adapters, network + * In some cases, such as specifying Elastic Fabric Adapters, * network interfaces must be used to specify security groups. This + * parameter tells the Compute Environment construct that this is your + * intention, and stops it from creating its own security groups. This * parameter is mutually exclusive with securityGroups in the Compute * Environment * From 68d2516af6bdfbeb48c908995749a7cea7c7e12a Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Thu, 18 Aug 2022 14:50:28 +0100 Subject: [PATCH 12/13] doc: fixed a couple of references to the previous parameter name --- packages/@aws-cdk/aws-batch/lib/compute-environment.ts | 3 +-- packages/@aws-cdk/aws-batch/test/compute-environment.test.ts | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts index bac94669dbf61..557eabd3ce4fe 100644 --- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts +++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts @@ -537,7 +537,6 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, if (props.computeResources.spotFleetRole !== undefined) { throw new Error('Spot fleet role must not be set for Fargate compute environments'); } - } else { // VALIDATE FOR ON_DEMAND AND SPOT if (props.computeResources.minvCpus) { @@ -565,7 +564,7 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment, throw new Error('You must specify either the launch template ID or launch template name in the request.'); } - // useLaunchTemplateNetworkInteface cannot have securityGroups defined + // useNetworkInterfaceSecurityGroups cannot have securityGroups defined if (props.computeResources.launchTemplate?.useNetworkInterfaceSecurityGroups && props.computeResources.securityGroups ) { throw new Error('securityGroups cannot be specified if launchTemplate useNetworkInterfaceSecurityGroups is active'); diff --git a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts index 3927a51ad80a5..85c03a3c1e36f 100644 --- a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts +++ b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts @@ -584,7 +584,7 @@ describe('Batch Compute Environment', () => { }); }); - describe('without useLaunchTemplateNetworkInterface', () => { + describe('without useNetworkInterfaceSecurityGroups', () => { test('should not have securityGroups', () => { // THEN throws(() => { From 0d557b41fe2af787c58a4868df81b034b08c913d Mon Sep 17 00:00:00 2001 From: Tim Cutts Date: Tue, 23 Aug 2022 19:07:50 +0100 Subject: [PATCH 13/13] Re-built integration test --- .../batch-with-efa.integ.snapshot/batch-stack.template.json | 6 +++++- .../aws-batch/test/batch-with-efa.integ.snapshot/integ.json | 2 +- .../aws-batch/test/batch-with-efa.integ.snapshot/tree.json | 5 +++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json index 6e1cd76577558..df41e422f123d 100644 --- a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json @@ -117,7 +117,11 @@ "Value": "batch-stack/vpc/PublicSubnet1" } ] - } + }, + "DependsOn": [ + "vpcPublicSubnet1DefaultRoute10708846", + "vpcPublicSubnet1RouteTableAssociation5D3F4579" + ] }, "vpcPrivateSubnet1Subnet934893E8": { "Type": "AWS::EC2::Subnet", diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json index 3becf288338f0..966e9214aa85c 100644 --- a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json @@ -5,7 +5,7 @@ "stacks": [ "batch-stack" ], - "assertionStack": "BatchWithEFATestDefaultTestDeployAssertDAD33663" + "assertionStack": "BatchWithEFATest/DefaultTest/DeployAssert" } } } \ No newline at end of file diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json index b36be167a1aff..d4072c3112b75 100644 --- a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json +++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json @@ -9,7 +9,7 @@ "path": "Tree", "constructInfo": { "fqn": "constructs.Construct", - "version": "10.1.51" + "version": "10.1.78" } }, "batch-stack": { @@ -579,6 +579,7 @@ "type": "MANAGED", "computeResources": { "launchTemplate": { + "useNetworkInterfaceSecurityGroups": true, "launchTemplateName": "EC2LaunchTemplateEFA" }, "maxvCpus": 256, @@ -672,7 +673,7 @@ "path": "BatchWithEFATest/DefaultTest/Default", "constructInfo": { "fqn": "constructs.Construct", - "version": "10.1.51" + "version": "10.1.78" } }, "DeployAssert": {