Merge branch 'master' into deprecate_addgroup

nrdg · Jul 29, 2023 · c1bd5c7 · c1bd5c7
2 parents c9bda75 + 33c73bf
commit c1bd5c7
Show file tree

Hide file tree

Showing 4 changed files with 93 additions and 88 deletions.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -2,4 +2,4 @@ repos:
 -   repo: https://github.com/python/black
     rev: 23.7.0
     hooks:
-    - id: black
+    - id: black
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -1,3 +1,8 @@
+v0.5.3 (February 03, 2022)
+==========================
+  * DOC: Update minimal required permissions (#302)
+  * BF: Use separate cloudformation templates for gpu jobs (#299)
+
 v0.5.2 (November 17, 2021)
 ==========================
   * ENH: Allow user to set number of GPUs for each job (#295)

diff --git a/RELEASE.rst b/RELEASE.rst
@@ -1,6 +1,5 @@
-v0.5.2 (November 17, 2021)
+v0.5.3 (February 03, 2022)
 ==========================
-  * ENH: Allow user to set number of GPUs for each job (#295)
-  * Use boto3 to get valid ec2 instance types (#284)
-  * Allow longer names for knots and fail earlier if they are too long (#282)
+  * DOC: Update minimal required permissions (#302)
+  * BF: Use separate cloudformation templates for gpu jobs (#299)
 
diff --git a/doc/minimal_permissions.txt b/doc/minimal_permissions.txt
@@ -5,105 +5,106 @@
             "Sid": "VisualEditor0",
             "Effect": "Allow",
             "Action": [
-                "ec2:CreateDhcpOptions",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:DescribeInstances",
                 "batch:CancelJob",
-                "ec2:AttachInternetGateway",
+                "batch:CreateComputeEnvironment",
+                "batch:CreateJobQueue",
+                "batch:DeleteComputeEnvironment",
+                "batch:DeleteJobQueue",
+                "batch:DeregisterJobDefinition",
                 "batch:DescribeComputeEnvironments",
-                "iam:AddRoleToInstanceProfile",
-                "ecr:DeleteRepository",
-                "ec2:DeleteRouteTable",
-                "ec2:CreateNetworkInterfacePermission",
-                "ec2:CreateRoute",
+                "batch:DescribeJobDefinitions",
+                "batch:DescribeJobQueues",
+                "batch:DescribeJobs",
+                "batch:ListJobs",
+                "batch:RegisterJobDefinition",
+                "batch:SubmitJob",
+                "batch:TerminateJob",
+                "batch:UpdateComputeEnvironment",
+                "batch:UpdateJobQueue"
+                "cloudformation:ListStacks",
+                "ec2:AssociateDhcpOptions",
+                "ec2:AssociateRouteTable",
+                "ec2:AttachInternetGateway",
+                "ec2:AuthorizeSecurityGroupEgress",
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:CreateDhcpOptions",
                 "ec2:CreateInternetGateway",
-                "ec2:DeleteInternetGateway",
-                "ecs:DeregisterContainerInstance",
-                "iam:ListPolicies",
-                "iam:GetRole",
-                "ec2:CreateTags",
-                "iam:ListEntitiesForPolicy",
-                "ecs:DeleteCluster",
-                "iam:DeleteRole",
-                "ecr:GetAuthorizationToken",
+                "ec2:CreateNatGateway",
+                "ec2:CreateNetworkAcl",
+                "ec2:CreateNetworkAclEntry",
                 "ec2:CreateNetworkInterface",
-                "s3:PutObject",
-                "ecs:ListContainerInstances",
+                "ec2:CreateNetworkInterfacePermission",
+                "ec2:CreateRoute",
+                "ec2:CreateRouteTable",
+                "ec2:CreateSecurityGroup",
                 "ec2:CreateSubnet",
-                "ec2:DescribeSubnets",
-                "ecr:InitiateLayerUpload",
-                "ec2:CreateVpnConnection",
-                "iam:CreateInstanceProfile",
-                "batch:DescribeJobQueues",
-                "ec2:CreateNatGateway",
-                "ec2:DescribeRegions",
+                "ec2:CreateTags",
                 "ec2:CreateVpc",
-                "s3:ListBucket",
-                "ec2:ModifySubnetAttribute",
-                "iam:ListInstanceProfilesForRole",
-                "iam:PassRole",
-                "batch:TerminateJob",
-                "batch:CreateJobQueue",
-                "batch:DescribeJobs",
-                "ec2:DescribeAvailabilityZones",
-                "batch:DeleteJobQueue",
-                "ec2:DeleteNetworkAcl",
-                "iam:DeleteInstanceProfile",
-                "ec2:AssociateDhcpOptions",
-                "iam:ListRoles",
+                "ec2:CreateVpcEndpoint",
+                "ec2:CreateVpcPeeringConnection",
+                "ec2:CreateVpnConnection",
                 "ec2:CreateVpnConnectionRoute",
-                "ec2:DescribeSecurityGroups",
-                "iam:CreatePolicy",
-                "ec2:DescribeVpcs",
+                "ec2:CreateVpnGateway",
+                "ec2:DeleteInternetGateway",
+                "ec2:DeleteNetworkAcl",
+                "ec2:DeleteRouteTable",
+                "ec2:DeleteSecurityGroup",
                 "ec2:DeleteSubnet",
-                "iam:RemoveRoleFromInstanceProfile",
-                "s3:CreateBucket",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy",
-                "ecr:BatchDeleteImage",
-                "ec2:AssociateRouteTable",
+                "ec2:DeleteVpc",
+                "ec2:DescribeAvailabilityZones",
+                "ec2:DescribeInstances",
                 "ec2:DescribeInternetGateways",
-                "batch:DeregisterJobDefinition",
-                "iam:DetachRolePolicy",
-                "iam:ListAttachedRolePolicies",
-                "ec2:CreateVpnGateway",
-                "ec2:CreateVpcPeeringConnection",
                 "ec2:DescribeNetworkAcls",
+                "ec2:DescribeRegions",
                 "ec2:DescribeRouteTables",
+                "ec2:DescribeSecurityGroups",
+                "ec2:DescribeSubnets",
+                "ec2:DescribeTags",
+                "ec2:DescribeVpcs",
+                "ec2:DetachInternetGateway",
+                "ec2:ModifySubnetAttribute",
+                "ec2:ModifyVpcAttribute",
+                "ec2:TerminateInstances",
                 "ecr:BatchCheckLayerAvailability",
-                "batch:CreateComputeEnvironment",
+                "ecr:BatchDeleteImage",
+                "ecr:CompleteLayerUpload",
                 "ecr:CreateRepository",
-                "ec2:CreateRouteTable",
-                "batch:ListJobs",
-                "ec2:DetachInternetGateway",
-                "ecr:PutImage",
-                "s3:GetObject",
-                "sts:AssumeRole",
+                "ecr:DeleteRepository",
                 "ecr:DescribeImages",
-                "batch:RegisterJobDefinition",
-                "batch:DescribeJobDefinitions",
-                "ec2:DeleteVpc",
-                "batch:DeleteComputeEnvironment",
-                "batch:SubmitJob",
-                "batch:UpdateComputeEnvironment",
-                "ecr:UploadLayerPart",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateNetworkAcl",
-                "ecr:CompleteLayerUpload",
-                "ec2:ModifyVpcAttribute",
                 "ecr:DescribeRepositories",
+                "ecr:GetAuthorizationToken",
+                "ecr:InitiateLayerUpload",
+                "ecr:PutImage",
+                "ecr:UploadLayerPart",
+                "ecs:DeleteCluster",
+                "ecs:DeregisterContainerInstance",
+                "ecs:ListContainerInstances",
+                "iam:AddRoleToInstanceProfile",
+                "iam:AttachRolePolicy",
+                "iam:CreateInstanceProfile",
+                "iam:CreatePolicy",
                 "iam:CreatePolicyVersion",
-                "ec2:AuthorizeSecurityGroupEgress",
-                "cloudformation:ListStacks",
-                "ec2:TerminateInstances",
+                "iam:CreateRole",
+                "iam:DeleteInstanceProfile",
+                "iam:DeletePolicyVersion",
+                "iam:DeleteRole",
+                "iam:DetachRolePolicy",
                 "iam:GetInstanceProfile",
-                "ec2:DescribeTags",
+                "iam:GetRole",
+                "iam:GetUser",
+                "iam:ListAttachedRolePolicies",
+                "iam:ListEntitiesForPolicy",
+                "iam:ListInstanceProfilesForRole",
+                "iam:ListPolicies",
                 "iam:ListPolicyVersions",
-                "ec2:CreateVpcEndpoint",
-                "ec2:DeleteSecurityGroup",
-                "ec2:CreateNetworkAclEntry",
-                "iam:DeletePolicyVersion",
-                "batch:UpdateJobQueue"
+                "iam:ListRoles",
+                "iam:PassRole",
+                "iam:RemoveRoleFromInstanceProfile",
+                "s3:CreateBucket",
+                "s3:GetObject",
+                "s3:ListBucket",
+                "s3:PutObject",
+                "sts:AssumeRole",
             ],
             "Resource": "*"
         },
@@ -113,12 +114,12 @@
             "Action": [
                 "cloudformation:CreateStack",
                 "cloudformation:DeleteStack",
-                "route53:AssociateVPCWithHostedZone",
                 "cloudformation:DescribeStacks"
+                "route53:AssociateVPCWithHostedZone",
             ],
             "Resource": [
-                "arn:aws:route53:::hostedzone/*",
                 "arn:aws:cloudformation:*:*:stack/*/*"
+                "arn:aws:route53:::hostedzone/*",
             ]
         }
     ]