Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configuring security groups for restricted environments

By default, Amazon ParallelCluster creates and configures security groups that allow all traffic between cluster nodes. In highly restricted environments, you might need to limit network access to only the ports required for cluster operation. This section describes how to configure custom security groups with restricted access for your Amazon ParallelCluster deployment.

Security groups overview

Amazon ParallelCluster uses security groups to control network traffic between the head node, compute nodes, and login nodes (if configured). By default, when Amazon ParallelCluster creates a cluster, it creates security groups that allow all traffic between nodes within the cluster. In environments with strict security requirements, you can provide custom security groups that limit traffic to only the necessary ports.

Security groups can be configured in the following sections of your cluster configuration:

For each of these sections, you can specify:

Required ports for cluster operation

When configuring custom security groups, you must ensure that the following ports are open between the appropriate nodes:

If you're using EFA (Elastic Fabric Adapter), you must also allow all traffic between compute nodes that have EFA enabled:

Creating custom security groups

To create custom security groups for your Amazon ParallelCluster deployment, follow these steps:

Here's an example of how to create security groups using the Amazon CLI:

# Create security group for head node
aws ec2 create-security-group \
  --group-name pcluster-head-node-sg \
  --description "Security group for ParallelCluster head node" \
  --vpc-id vpc-12345678

# Create security group for compute nodes
aws ec2 create-security-group \
  --group-name pcluster-compute-node-sg \
  --description "Security group for ParallelCluster compute nodes" \
  --vpc-id vpc-12345678

# Add rules to allow necessary traffic between head and compute nodes
# (Add specific rules based on the required ports listed above)

Configuring security groups in the cluster configuration

Once you've created your custom security groups, you can reference them in your cluster configuration file:

# Example cluster configuration with custom security groups
HeadNode:
  ...
  Networking:
    SubnetId: subnet-12345678
    SecurityGroups:
      - sg-headnode12345  # Custom security group for head node
    # Or use AdditionalSecurityGroups if you want to keep the default security groups
    # AdditionalSecurityGroups:
    #   - sg-additional12345
  ...

Scheduling:
  Scheduler: slurm
  SlurmQueues:
    - Name: queue1
      ...
      Networking:
        SubnetIds:
          - subnet-12345678
        SecurityGroups:
          - sg-computenode12345  # Custom security group for compute nodes
        # Or use AdditionalSecurityGroups if you want to keep the default security groups
        # AdditionalSecurityGroups:
        #   - sg-additional12345
      ...

# If using login nodes
LoginNodes:
  Pools:
    - Name: login-pool
      ...
      Networking:
        SubnetIds:
          - subnet-12345678
        SecurityGroups:
          - sg-loginnode12345  # Custom security group for login nodes
        # Or use AdditionalSecurityGroups if you want to keep the default security groups
        # AdditionalSecurityGroups:
        #   - sg-additional12345
      ...

When using SecurityGroups, Amazon ParallelCluster will use only the security groups you specify, replacing the default ones. When using AdditionalSecurityGroups, Amazon ParallelCluster will use both the default security groups it creates and the additional ones you specify.

Using VPC endpoints in restricted environments

In highly restricted environments, you might want to deploy Amazon ParallelCluster in a subnet without internet access. In this case, you'll need to configure VPC endpoints to allow the cluster to communicate with Amazon services. For detailed instructions, see Amazon ParallelCluster in a single subnet with no internet access.

When using VPC endpoints, ensure that your security groups allow traffic to and from the VPC endpoints. You can do this by adding the security groups associated with the VPC endpoints to the AdditionalSecurityGroups configuration for your head node and compute nodes.

HeadNode:
  ...
  Networking:
    SubnetId: subnet-1234567890abcdef0
    AdditionalSecurityGroups:
      - sg-abcdef01234567890  # Security group that enables communication with VPC endpoints
  ...

Scheduling:
  Scheduler: slurm
  SlurmQueues:
    - ...
      Networking:
        SubnetIds:
          - subnet-1234567890abcdef0
        AdditionalSecurityGroups:
          - sg-1abcdef01234567890  # Security group that enables communication with VPC endpoints

Best practices for security group configuration

When configuring security groups for Amazon ParallelCluster in restricted environments, consider the following best practices:

Troubleshooting security group issues

If you encounter issues after configuring custom security groups, consider the following troubleshooting steps:

If you continue to experience issues, you can revert to using the default security groups created by Amazon ParallelCluster by removing the SecurityGroups configuration from your cluster configuration file.