|
| 1 | +:orphan: |
| 2 | + |
| 3 | +.. _aws_cli: |
| 4 | + |
| 5 | + |
| 6 | +############################ |
| 7 | +Create AWS role with AWS CLI |
| 8 | +############################ |
| 9 | + |
| 10 | +1. Install AWS CLI (see instructions `here <https://aws.amazon.com/cli/>`_). |
| 11 | + |
| 12 | +2. Protect your role by creating a hard to guess password that will be used to authenticate Lightning (You will need to pass it to Lightning for authentication). In our example we will use `dummy`. |
| 13 | + |
| 14 | +3. Create a role called `lightning-cloud` using the following command (replace <YOUR-HARD-TO-GUESS-PASSWORD> with your own): |
| 15 | + |
| 16 | +.. code:: bash |
| 17 | +
|
| 18 | + aws iam create-role \ |
| 19 | + --role-name lightning-cloud \ |
| 20 | + --assume-role-policy-document '{"Statement":[{"Action":"sts:AssumeRole","Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::748115360335:root"}, "Condition": {"StringEquals": {"sts:ExternalId": "<YOUR-HARD-TO-GUESS-PASSWORD>"}}}]}' \ |
| 21 | + --description " " \ |
| 22 | + --max-session-duration 43200 |
| 23 | +
|
| 24 | +4. Create a file `iam-policy.json` with the following permissions required for Lightning to manage cloud infrastructure for you: |
| 25 | + |
| 26 | +.. code:: json |
| 27 | +
|
| 28 | + { |
| 29 | + "Version": "2012-10-17", |
| 30 | + "Statement": [ |
| 31 | + { |
| 32 | + "Action": [ |
| 33 | + "autoscaling:*", |
| 34 | + "cloudwatch:*", |
| 35 | + "ec2:*", |
| 36 | + "ecr:*", |
| 37 | + "eks:*", |
| 38 | + "elasticloadbalancing:*", |
| 39 | + "events:*", |
| 40 | + "guardduty:*", |
| 41 | + "iam:*", |
| 42 | + "logs:*", |
| 43 | + "route53resolver:*", |
| 44 | + "s3:*", |
| 45 | + "sns:*", |
| 46 | + "sqs:*", |
| 47 | + "tag:GetResources", |
| 48 | + "resource-groups:SearchResources" |
| 49 | + ], |
| 50 | + "Effect": "Allow", |
| 51 | + "Resource": "*" |
| 52 | + }, |
| 53 | + { |
| 54 | + "Effect": "Allow", |
| 55 | + "Action": "iam:CreateServiceLinkedRole", |
| 56 | + "Resource": "*", |
| 57 | + "Condition": { |
| 58 | + "StringLike": { |
| 59 | + "iam:AWSServiceName": [ |
| 60 | + "guardduty.amazonaws.com", |
| 61 | + "malware-protection.guardduty.amazonaws.com" |
| 62 | + ] |
| 63 | + } |
| 64 | + } |
| 65 | + }, |
| 66 | + { |
| 67 | + "Effect": "Allow", |
| 68 | + "Action": "iam:CreateServiceLinkedRole", |
| 69 | + "Resource": "*", |
| 70 | + "Condition": { |
| 71 | + "StringEquals": { |
| 72 | + "iam:AWSServiceName": [ |
| 73 | + "autoscaling.amazonaws.com", |
| 74 | + "ec2scheduled.amazonaws.com", |
| 75 | + "elasticloadbalancing.amazonaws.com", |
| 76 | + "spot.amazonaws.com", |
| 77 | + "spotfleet.amazonaws.com", |
| 78 | + "transitgateway.amazonaws.com" |
| 79 | + ] |
| 80 | + } |
| 81 | + } |
| 82 | + } |
| 83 | + ] |
| 84 | + } |
| 85 | +
|
| 86 | +5. Create a IAM policy and associate it with the role we just created, and pass in the path to your new file: |
| 87 | + |
| 88 | +.. code:: bash |
| 89 | +
|
| 90 | + aws iam create-policy \ |
| 91 | + --policy-name lightning-cloud \ |
| 92 | + --description "policy granting lightning controlplane permissions" \ |
| 93 | + --policy-document file:///my_dir/iam-policy.json |
| 94 | +
|
| 95 | +6. Fetch the role ARN so you can attach the policy: |
| 96 | + |
| 97 | +.. code:: bash |
| 98 | +
|
| 99 | + aws iam get-role --role-name lightning-cloud --output json --query Role.Arn |
| 100 | +
|
| 101 | +7. Attach the policy to the IAM role you just created: |
| 102 | + |
| 103 | +.. code:: bash |
| 104 | +
|
| 105 | + aws iam attach-role-policy \ |
| 106 | + --role-name lightning-cloud \ |
| 107 | + --policy-arn arn:aws:iam::1234567890:policy/lightning-cloud |
| 108 | +
|
| 109 | +------ |
| 110 | + |
| 111 | +********************** |
| 112 | +Next: Create a cluster |
| 113 | +********************** |
| 114 | + |
| 115 | +You are now ready to create a Lightning cluster! |
| 116 | + |
| 117 | +.. raw:: html |
| 118 | + |
| 119 | + <div class="display-card-container"> |
| 120 | + <div class="row"> |
| 121 | + |
| 122 | +.. Add callout items below this line |
| 123 | +
|
| 124 | +.. displayitem:: |
| 125 | + :header: Create cluster |
| 126 | + :description: Create an AWS cluster for running ligthning apps, skip to step 2 |
| 127 | + :button_link: create_cluster.html |
| 128 | + :col_css: col-md-12 |
| 129 | + :height: 170 |
| 130 | + |
| 131 | +.. raw:: html |
| 132 | + |
| 133 | + </div> |
| 134 | + </div> |
0 commit comments