使用 Terraform 部署 ParallelCluster API - Amazon ParallelCluster
定义一个 Terraform 项目部署 API所需的权限
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

使用 Terraform 部署 ParallelCluster API

在本教程中，您将定义一个简单的 Terraform 项目来部署 API。 ParallelCluster

先决条件

  • Terraform v1.5.7+ 已安装。

  • 具有部署 ParallelCluster API 权限的 IAM 角色。请参阅 所需的权限。

定义一个 Terraform 项目

  1. 创建一个名为的目录my-pcluster-api。

    您创建的所有文件都将位于此目录中。

  2. 创建用于配置provider.tf Amazon 提供程序的文件。

    provider "aws" {
  region  = var.region
  profile = var.profile
}

  3. 使用 ParallelCluster模块创建文件main.tf以定义资源。

    module "parallelcluster_pcluster_api" {
  source = "aws-tf/parallelcluster/aws//modules/pcluster_api"
  version = "1.0.0"

  region                = var.region
  api_stack_name        = var.api_stack_name
  api_version           = var.api_version
  deploy_pcluster_api   = true
  parameters = {
    EnableIamAdminAccess = "true"
  }
}

  4. 创建文件variables.tf以定义可以为此项目注入的变量。

    variable "region" {
  description = "The region the ParallelCluster API is deployed in."
  type        = string
  default     = "us-east-1"
}

variable "profile" {
  type        = string
  description = "The AWS profile used to deploy the clusters."
  default     = null
}

variable "api_stack_name" {
  type        = string
  description = "The name of the CloudFormation stack used to deploy the ParallelCluster API."
  default     = "ParallelCluster"
}

variable "api_version" {
  type        = string
  description = "The version of the ParallelCluster API."
}

  5. 创建文件terraform.tfvars以设置变量的任意值。

    下面的文件us-east-1使用堆栈名称部署了 ParallelCluster API 3.10.0。MyParallelClusterAPI-310您将能够使用其堆栈名称来引用此 ParallelCluster API 部署。

    region = "us-east-1"
api_stack_name = "MyParallelClusterAPI-310"
api_version = "3.10.0"

  6. 创建文件outputs.tf以定义此项目返回的输出。

    output "pcluster_api_stack_outputs" {
  value = module.parallelcluster_pcluster_api.stack_outputs
}

    项目目录是：

    my-pcluster-api
├── main.tf - Terraform entrypoint to define the resources using the ParallelCluster module.
├── outputs.tf - Defines the outputs returned by Terraform.
├── providers.tf - Configures the AWS provider.
├── terraform.tfvars - Set the arbitrary values for the variables, i.e. region, PCAPI version, PCAPI stack name
└── variables.tf - Defines the variables, e.g. region, PCAPI version, PCAPI stack name.

部署 API

要部署 API，请按顺序运行标准的 Terraform 命令。

  1. 构建项目：

    terraform init

  2. 定义部署计划：

    terraform plan -out tfplan

  3. 部署计划：

    terraform apply tfplan

所需的权限

你需要以下权限才能使用 Terraform 部署 ParallelCluster API：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudformation:DescribeStacks",
                "cloudformation:GetTemplate"
            ],
            "Resource": "arn:PARTITION:cloudformation:REGION:ACCOUNT:stack/*",
            "Effect": "Allow",
            "Sid": "CloudFormationRead"
        },
        {
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:CreateChangeSet"
            ],
            "Resource": "arn:PARTITION:cloudformation:REGION:ACCOUNT:stack/MyParallelClusterAPI*",
            "Effect": "Allow",
            "Sid": "CloudFormationWrite"
        },
        {
            "Action": [
                "cloudformation:CreateChangeSet"
            ],
            "Resource": [
                "arn:PARTITION:cloudformation:REGION:aws:transform/Include",
                "arn:PARTITION:cloudformation:REGION:aws:transform/Serverless-2016-10-31"
            ],
            "Effect": "Allow",
            "Sid": "CloudFormationTransformWrite"
        },
        {
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:PARTITION:s3:::*-aws-parallelcluster/parallelcluster/*/api/ParallelCluster.openapi.yaml",
                "arn:PARTITION:s3:::*-aws-parallelcluster/parallelcluster/*/layers/aws-parallelcluster/lambda-layer.zip"
            ],
            "Effect": "Allow",
            "Sid": "S3ParallelClusterArtifacts"
        },
        {
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:GetRole",
                "iam:CreatePolicy",
                "iam:DeletePolicy",
                "iam:GetPolicy",
                "iam:GetRolePolicy",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:PutRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:ListPolicyVersions"
            ],
            "Resource": [
                "arn:PARTITION:iam::ACCOUNT:role/*",
                "arn:PARTITION:iam::ACCOUNT:policy/*"
            ],
            "Effect": "Allow",
            "Sid": "IAM"
        },
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:PARTITION:iam::ACCOUNT:role/ParallelClusterLambdaRole-*",
                "arn:PARTITION:iam::ACCOUNT:role/APIGatewayExecutionRole-*"
            ],
            "Effect": "Allow",
            "Sid": "IAMPassRole"
        },
        {
            "Action": [
                "lambda:CreateFunction",
                "lambda:DeleteFunction",
                "lambda:GetFunction",
                "lambda:PublishLayerVersion",
                "lambda:DeleteLayerVersion",
                "lambda:GetLayerVersion",
                "lambda:TagResource",
                "lambda:UntagResource"
            ],
            "Resource": [
                "arn:PARTITION:lambda:REGION:ACCOUNT:layer:PCLayer-*",
                "arn:PARTITION:lambda:REGION:ACCOUNT:function:*-ParallelClusterFunction-*"
            ],
            "Effect": "Allow",
            "Sid": "Lambda"
        },
        {
            "Action": [
                "logs:CreateLogGroup",
                "logs:DeleteLogGroup",
                "logs:DescribeLogGroups",
                "logs:PutRetentionPolicy",
                "logs:TagLogGroup",
                "logs:UntagLogGroup"
            ],
            "Resource": [
                "arn:PARTITION:logs:REGION:ACCOUNT:log-group:/aws/lambda/*-ParallelClusterFunction-*"
            ],
            "Effect": "Allow",
            "Sid": "Logs"
        },
        {
            "Action": [
                "apigateway:DELETE",
                "apigateway:GET",
                "apigateway:PATCH",
                "apigateway:POST",
                "apigateway:PUT",
                "apigateway:UpdateRestApiPolicy"
            ],
            "Resource": [
                "arn:PARTITION:apigateway:REGION::/restapis",
                "arn:PARTITION:apigateway:REGION::/restapis/*",
                "arn:PARTITION:apigateway:REGION::/tags/*"
            ],
            "Effect": "Allow",
            "Sid": "APIGateway"
        }
    ]
}