Merge pull request #290 from aws/bump/0.23.0

chore(release): 0.23.0

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v2.1.2
+      uses: actions/setup-node@v2.1.4
       with:
         node-version: ${{ matrix.node-version }}
     - run: yarn global add typescript

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [0.23.0](https://github.com/aws/aws-rfdk/compare/v0.22.0...v0.23.0) (2021-01-08)
+
+
+### Supported CDK Version
+
+* [1.83.0](https://github.com/aws/aws-cdk/releases/tag/v1.83.0)
+
+
+### Officially Supported Deadline Versions
+
+* [10.1.9.2 to 10.1.12.1](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/release-notes.html)
+
+
+### Features
+
+* **core:** Addition of SessionManagerHelper ([#266](https://github.com/aws/aws-rfdk/issues/266)) ([08bd333](https://github.com/aws/aws-rfdk/commit/08bd333d65ac8821812fdd15520f8b3ff6a0c6dc)), closes [#265](https://github.com/aws/aws-rfdk/issues/265)
+* **deadline:** allow providing subnets for RenderQueue's ALB ([#264](https://github.com/aws/aws-rfdk/issues/264)) ([53088fb](https://github.com/aws/aws-rfdk/commit/53088fb788851cb8132dacfea77562951f1d89ca))
+
 ## [0.22.0](https://github.com/aws/aws-rfdk/compare/v0.21.0...v0.22.0) (2020-12-16)
 
 

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2018-2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+   Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

NOTICE

@@ -1,2 +1,2 @@
 Render Farm Deployment Kit on AWS (RFDK)
-Copyright 2018-2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.

THIRD-PARTY

@@ -214,7 +214,7 @@ limitations under the License.
 ------
 
 ** openssl -- https://www.openssl.org/
-Copyright (c) 1998-2020 The OpenSSL Project
+Copyright (c) 1998-2021 The OpenSSL Project
 Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
 All rights reserved.
 

examples/deadline/All-In-AWS-Infrastructure-Basic/python/README.md

@@ -32,8 +32,16 @@ These instructions assume that your working directory is `examples/deadline/All-
     popd
     pip install ../../../../dist/python/aws-rfdk-<version>.tar.gz
     ```
-4.  Change the value in the `deadline_client_linux_ami_map` variable in `package/config.py` to include the region + AMI ID mapping of your EC2 AMI(s) with Deadline Worker.
+4.  Change the value in the `deadline_client_linux_ami_map` variable in `package/config.py` to include the region + AMI ID mapping of your EC2 AMI(s) with Deadline Worker. You can use the following AWS CLI query to find AMI ID's:
+    ```bash
+    aws --region <region> ec2 describe-images \
+    --owners 357466774442 \
+    --filters "Name=name,Values=*Worker*" "Name=name,Values=*<version>*" \
+    --query 'Images[*].[ImageId, Name]' \
+    --output text
+    ```
 
+    And enter it into this section of `package/config.py`:
     ```python
     # For example, in the us-west-2 region
     self.deadline_client_linux_ami_map: Mapping[str, str] = {
@@ -104,10 +112,7 @@ These instructions assume that your working directory is `examples/deadline/All-
     # Set this value to the version of AWS Thinkbox Deadline you'd like to deploy to your farm. Deadline 10.1.9 and up are supported.
     RFDK_DEADLINE_VERSION=<version_of_deadline>
 
-    npx --package=aws-rfdk@${RFDK_VERSION} stage-deadline \
-        --deadlineInstallerURI s3://thinkbox-installers/Deadline/${RFDK_DEADLINE_VERSION}/Linux/DeadlineClient-${RFDK_DEADLINE_VERSION}-linux-x64-installer.run \
-        --dockerRecipesURI s3://thinkbox-installers/DeadlineDocker/${RFDK_DEADLINE_VERSION}/DeadlineDocker-${RFDK_DEADLINE_VERSION}.tar.gz \
-        --output stage
+    npx --package=aws-rfdk@${RFDK_VERSION} stage-deadline ${RFDK_DEADLINE_VERSION} --output stage
     ```
 12. Deploy all the stacks in the sample app:
 

examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/config.py

@@ -18,8 +18,10 @@ class AppConfig:
     TODO: Fill these in with your own values.
     """
     def __init__(self):
-        # A map of regions to Deadline Client Linux AMIs.
-        self.deadline_client_linux_ami_map: Mapping[str, str] = {'region': 'ami-id'}
+        # A map of regions to Deadline Client Linux AMIs.As an example, the Linux Deadline 10.1.12.1 AMI ID
+        # from us-west-2 is filled in. It can be used as-is, added to, or replaced. Ideally the version here
+        #  should match the one used for staging the render queue and usage based licensing recipes.
+        self.deadline_client_linux_ami_map: Mapping[str, str] = {'us-west-2': 'ami-039f0c1faba28b015'}
 
         # A secret (in binary form) in SecretsManager that stores the UBL certificates in a .zip file.
         self.ubl_certificate_secret_arn: str =\

examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/lib/compute_tier.py

@@ -24,6 +24,7 @@
 
 from aws_rfdk import (
     HealthMonitor,
+    SessionManagerHelper,
 )
 from aws_rfdk.deadline import (
     InstanceUserDataProvider,
@@ -117,6 +118,11 @@ def __init__(self, scope: Construct, stack_id: str, *, props: ComputeTierProps,
             user_data_provider=UserDataProvider(self, 'UserDataProvider')
         )
 
+        # This is an optional feature that will set up your EC2 instances to be enabled for use with
+        # the Session Manager. These worker fleet instances aren't available through a public subnet,
+        # so connecting to them directly through SSH isn't easy.
+        SessionManagerHelper.grant_permissions_to(self.worker_fleet)
+
         if props.usage_based_licensing and props.licenses:
             props.usage_based_licensing.grant_port_access(self.worker_fleet, props.licenses)
 

examples/deadline/All-In-AWS-Infrastructure-Basic/python/package/lib/service_tier.py

@@ -31,6 +31,7 @@
 from aws_rfdk import (
     DistinguishedName,
     IMountableLinuxFilesystem,
+    SessionManagerHelper,
     X509CertificatePem
 )
 from aws_rfdk.deadline import (
@@ -86,9 +87,10 @@ def __init__(self, scope: Construct, stack_id: str, *, props: ServiceTierProps,
         """
         super().__init__(scope, stack_id, **kwargs)
 
-        # A bastion host to connect to the render farm with.
-        # The bastion host is for convenience (e.g. SSH into RenderQueue and WorkerFleet instances).
-        # This is not a critical component of the farm, so can safely be removed.
+        # Bastion instance for convenience (e.g. SSH into RenderQueue and WorkerFleet instances).
+        # Not a critical component of the farm, so this can be safely removed. An alternative way
+        # to access your hosts is also provided by the Session Manager, which is also configured
+        # later in this example.
         self.bastion = BastionHostLinux(
             self,
             'Bastion',
@@ -162,6 +164,14 @@ def __init__(self, scope: Construct, stack_id: str, *, props: ServiceTierProps,
         )
         self.render_queue.connections.allow_default_port_from(self.bastion)
 
+        # This is an optional feature that will set up your EC2 instances to be enabled for use with
+        # the Session Manager. RFDK deploys EC2 instances that aren't available through a public subnet,
+        # so connecting to them by SSH isn't easy. This is an option to quickly access hosts without
+        # using a bastion instance.
+        # It's important to note that the permissions need to be granted to the render queue's ASG,
+        # rather than the render queue itself.
+        SessionManagerHelper.grant_permissions_to(self.render_queue.asg)
+
         if props.ubl_licenses:
             if not props.ubl_certs_secret_arn:
                 raise ValueError('UBL certificates secret ARN is required when using UBL but was not specified.')
@@ -175,5 +185,10 @@ def __init__(self, scope: Construct, stack_id: str, *, props: ServiceTierProps,
                 render_queue=self.render_queue,
                 certificate_secret=ubl_cert_secret,
             )
+
+            # Another optional usage of the SessionManagerHelper that demonstrates how to configure the UBL
+            # construct's ASG for access. Note that this construct also requires you to apply the permissions
+            # to its ASG property.
+            SessionManagerHelper.grant_permissions_to(self.ubl_licensing.asg)
         else:
             self.ubl_licensing = None

examples/deadline/All-In-AWS-Infrastructure-Basic/python/setup.py

@@ -17,8 +17,8 @@
     packages=setuptools.find_packages(where="package"),
 
     install_requires=[
-        "aws-cdk.core==1.78.0",
-        "aws-rfdk==0.22.0"
+        "aws-cdk.core==1.83.0",
+        "aws-rfdk==0.23.0"
     ],
 
     python_requires=">=3.7",

examples/deadline/All-In-AWS-Infrastructure-Basic/ts/README.md

@@ -18,8 +18,16 @@ These instructions assume that your working directory is `examples/deadline/All-
     ```
     yarn install
     ```
-3.  Change the value in the `deadlineClientLinuxAmiMap` variable in `bin/config.ts` to include the region + AMI ID mapping of your EC2 AMI(s) with Deadline Worker.
+3.  Change the value in the `deadlineClientLinuxAmiMap` variable in `bin/config.ts` to include the region + AMI ID mapping of your EC2 AMI(s) with Deadline Worker. You can use the following AWS CLI query to find AMI ID's:
+    ```
+    aws --region <region> ec2 describe-images \
+    --owners 357466774442 \
+    --filters "Name=name,Values=*Worker*" "Name=name,Values=*<version>*" \
+    --query 'Images[*].[ImageId, Name]' \
+    --output text
+    ```
 
+    And enter it into this section of `bin/config.ts`:
     ```ts
     // For example, in the us-west-2 region
     public readonly deadlineClientLinuxAmiMap: Record<string, string> = {

examples/deadline/All-In-AWS-Infrastructure-Basic/ts/lib/compute-tier.ts

@@ -12,7 +12,7 @@ import {
 import * as cdk from '@aws-cdk/core';
 import {
   IHost,
-  InstanceUserDataProvider,  
+  InstanceUserDataProvider,
   IRenderQueue,
   IWorkerFleet,
   UsageBasedLicense,
@@ -22,6 +22,7 @@ import {
 import {
   HealthMonitor,
   IHealthMonitor,
+  SessionManagerHelper,
 } from 'aws-rfdk';
 import { Asset } from '@aws-cdk/aws-s3-assets';
 import * as path from 'path'
@@ -72,15 +73,15 @@ class UserDataProvider extends InstanceUserDataProvider {
   }
   preRenderQueueConfiguration(host: IHost): void {
     host.userData.addCommands('echo preRenderQueueConfiguration');
-  }  
+  }
   preWorkerConfiguration(host: IHost): void {
     host.userData.addCommands('echo preWorkerConfiguration');
   }
   postWorkerLaunch(host: IHost): void {
     host.userData.addCommands('echo postWorkerLaunch');
     if (host.node.scope != undefined) {
       const testScript = new Asset(
-        host.node.scope as cdk.Construct, 
+        host.node.scope as cdk.Construct,
         'SampleAsset',
         {path: path.join(__dirname, '..', '..', 'scripts', 'configure_worker.sh')},
       );
@@ -119,7 +120,7 @@ export class ComputeTier extends cdk.Stack {
    */
   constructor(scope: cdk.Construct, id: string, props: ComputeTierProps) {
     super(scope, id, props);
-    
+
     this.healthMonitor = new HealthMonitor(this, 'HealthMonitor', {
       vpc: props.vpc,
       // TODO - Evaluate deletion protection for your own needs. This is set to false to
@@ -137,6 +138,11 @@ export class ComputeTier extends cdk.Stack {
       userDataProvider: new UserDataProvider(this, 'UserDataProvider'),
     });
 
+    // This is an optional feature that will set up your EC2 instances to be enabled for use with
+    // the Session Manager. These worker fleet instances aren't available through a public subnet,
+    // so connecting to them directly through SSH isn't easy.
+    SessionManagerHelper.grantPermissionsTo(this.workerFleet);
+
     if (props.usageBasedLicensing && props.licenses) {
       props.usageBasedLicensing.grantPortAccess(this.workerFleet, props.licenses);
     }

examples/deadline/All-In-AWS-Infrastructure-Basic/ts/lib/service-tier.ts

@@ -22,7 +22,6 @@ import {
 } from 'aws-rfdk';
 import {
   DatabaseConnection,
-  IRenderQueue,
   RenderQueue,
   Repository,
   Stage,
@@ -34,6 +33,7 @@ import {
   Secret,
 } from '@aws-cdk/aws-secretsmanager';
 import { Duration } from '@aws-cdk/core';
+import { SessionManagerHelper } from 'aws-rfdk/lib/core';
 
 /**
  * Properties for {@link ServiceTier}.
@@ -90,7 +90,7 @@ export class ServiceTier extends cdk.Stack {
   /**
    * The render queue.
    */
-  public readonly renderQueue: IRenderQueue;
+  public readonly renderQueue: RenderQueue;
 
   /**
    * The UBL licensing construct. (License Forwarder)
@@ -111,8 +111,10 @@ export class ServiceTier extends cdk.Stack {
   constructor(scope: cdk.Construct, id: string, props: ServiceTierProps) {
     super(scope, id, props);
 
-    // Bastion instance for convenience (e.g. SSH into RenderQueue and WorkerFleet instances)
-    // Not a critical component of the farm, so this can be safely removed
+    // Bastion instance for convenience (e.g. SSH into RenderQueue and WorkerFleet instances).
+    // Not a critical component of the farm, so this can be safely removed. An alternative way
+    // to access your hosts is also provided by the Session Manager, which is also configured
+    // later in this example.
     this.bastion = new BastionHostLinux(this, 'Bastion', {
       vpc: props.vpc,
       subnetSelection: {
@@ -173,11 +175,19 @@ export class ServiceTier extends cdk.Stack {
     });
     this.renderQueue.connections.allowDefaultPortFrom(this.bastion);
 
+    // This is an optional feature that will set up your EC2 instances to be enabled for use with
+    // the Session Manager. RFDK deploys EC2 instances that aren't available through a public subnet,
+    // so connecting to them by SSH isn't easy. This is an option to quickly access hosts without
+    // using a bastion instance.
+    // It's important to note that the permissions need to be granted to the render queue's ASG,
+    // rather than the render queue itself.
+    SessionManagerHelper.grantPermissionsTo(this.renderQueue.asg);
+
     if (props.ublLicenses) {
       if (!props.ublCertsSecretArn) {
         throw new Error('UBL licenses were set but no UBL Certs Secret Arn was set.');
       }
-      const ublCertSecret = Secret.fromSecretArn(this, 'UBLCertsSecret', props.ublCertsSecretArn);
+      const ublCertSecret = Secret.fromSecretCompleteArn(this, 'UBLCertsSecret', props.ublCertsSecretArn);
 
       this.ublLicensing = new UsageBasedLicensing(this, 'UBLLicensing', {
         vpc: props.vpc,
@@ -186,6 +196,11 @@ export class ServiceTier extends cdk.Stack {
         renderQueue: this.renderQueue,
         certificateSecret: ublCertSecret,
       });
+
+      // Another optional usage of the SessionManagerHelper that demonstrates how to configure the UBL
+      // construct's ASG for access. Note that this construct also requires you to apply the permissions
+      // to its ASG property.
+      SessionManagerHelper.grantPermissionsTo(this.ublLicensing.asg);
     }
   }
 }

examples/deadline/All-In-AWS-Infrastructure-Basic/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-in-farm-basic",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "bin": {
     "app": "bin/app.js"
   },
@@ -18,14 +18,14 @@
     "watch": "tsc -w"
   },
   "devDependencies": {
-    "@types/node": "^14.14.14",
-    "aws-cdk": "1.78.0",
+    "@types/node": "^14.14.20",
+    "aws-cdk": "1.83.0",
     "ts-node": "^9.1.1",
     "typescript": "~4.1.3"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.78.0",
-    "aws-rfdk": "0.22.0",
+    "@aws-cdk/core": "1.83.0",
+    "aws-rfdk": "0.23.0",
     "source-map-support": "^0.5.19"
   }
 }

examples/deadline/All-In-AWS-Infrastructure-SEP/python/setup.py

@@ -17,8 +17,8 @@
     packages=setuptools.find_packages(where="package"),
 
     install_requires=[
-        "aws-cdk.core==1.78.0",
-        "aws-rfdk==0.22.0"
+        "aws-cdk.core==1.83.0",
+        "aws-rfdk==0.23.0"
     ],
 
     python_requires=">=3.7",

examples/deadline/All-In-AWS-Infrastructure-SEP/ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-in-farm-sep",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "bin": {
     "app": "bin/app.js"
   },
@@ -18,14 +18,14 @@
     "watch": "tsc -w"
   },
   "devDependencies": {
-    "@types/node": "^14.14.14",
-    "aws-cdk": "1.78.0",
+    "@types/node": "^14.14.20",
+    "aws-cdk": "1.83.0",
     "ts-node": "^9.1.1",
     "typescript": "~4.1.3"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.78.0",
-    "aws-rfdk": "0.22.0",
+    "@aws-cdk/core": "1.83.0",
+    "aws-rfdk": "0.23.0",
     "source-map-support": "^0.5.19"
   }
 }

integ/LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2018-2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+   Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.