Hi,
It seems that it is not possible to create MapR cluster via AWS CloudFormation using template mapr-cloud-templates/1.11/aws/aws_cf_maprcluster_role.yml because of missing policy. I had error as below:
2019-03-09 11:18:08,355 callbacks 66 [INFO]: Patching https://172.24.0.117:9443/api/process: {"status": "Failed to update autoscaling group: An error occurred (AccessDenied) when calling the DisableMetricsCollection operation: User: arn:aws:sts::627117276007:assumed-role/mapr-role-my.cluster.com-eu-west-2/i-06df6d7ff533e7db9 is not authorized to perform: aut", "state": "STATUS"}
2019-03-09 11:18:08,374 callbacks 423 [ERROR]:
An exception occurred during task execution. The full traceback is:
Traceback (
most recent call last):
File "/tmp/ansible_ec2_asg_payload_geokI5/main.py",
line 1067,
in create_autoscaling_group
connection.disable_metrics_collection(AutoScalingGroupName=group_name,
Metrics=metrics_list)
File "/opt/mapr/installer/build/installer/lib/python2.7/site-packages/botocore/client.py",
line 314,
in _api_call
return self._make_api_call(operation_name,
kwargs)
File "/opt/mapr/installer/build/installer/lib/python2.7/site-packages/botocore/client.py",
line 612,
in _make_api_call
raise error_class(parsed_response,
operation_name)
ClientError: An error occurred (AccessDenied) when calling the DisableMetricsCollection operation: User: arn:aws:sts::627117276007:assumed-role/mapr-role-my.cluster.com-eu-west-2/i-06df6d7ff533e7db9 is not authorized to perform: autoscaling:DisableMetricsCollection on resource: arn:aws:autoscaling:eu-west-2:627117276007:autoScalingGroup:aae737ee-8a37-4b59-b1e1-6d90f31ec0d1:autoScalingGroupName/MapRCommunity-ClusterNodes-6WO42QARMAA8
Task: update asg(ec2_asg {
u'min_size': u'{{updated.new_count}}',
u'desired_capacity': u'{{updated.new_count}}',
u'name': u'{{ provider.config.auto_scaling_group }}',
u'region': u'{{ provider.config.aws_region }}',
u'suspend_processes': u'{{ processes }}',
u'validate_certs': False,
u'max_size': u'{{updated.new_count}}'})
-> failed =>
{
"changed": false
}
2019-03-09 11:18:08,376 installrunner 415 [ERROR]: Host: localhost has 1 failures
2019-03-09 11:18:08,376 common 254 [ERROR]: Failed to provision cloud resources.
2019-03-09 11:18:08,377 common 255 [ERROR]: Exiting with 1
2019-03-09 11:18:08,377 common 257 [INFO]: Asked to exit with status 1
Proper Policy should look like below:
MapRInstallerRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join [ "-", ["mapr-role", !Ref "clusterName", !Ref "AWS::Region"]]
Path: "/"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Principal:
Service:
- "ec2.amazonaws.com"
Action:
- "sts:AssumeRole"
Policies:
-
PolicyName: "maprinstaller"
PolicyDocument:
Version: "2012-10-17"
Statement:
Effect: "Allow"
Resource: ""
Action:
- "autoscaling:Describe"
- "autoscaling:CreateLaunchConfiguration"
- "autoscaling:DeleteLaunchConfiguration"
- "autoscaling:UpdateAutoScalingGroup"
- "autoscaling:SuspendProcesses"
- "autoscaling:DisableMetricsCollection"
- "ec2:CreateKeyPair"
- "ec2:DeleteKeyPair"
- "ec2:ImportKeyPair"
- "ec2:DescribeKeyPairs"
- "ec2:DescribeInstances"
- "ec2:DescribeInstanceAttribute"
- "ec2:ModifyInstanceAttribute"
- "ec2:DescribeSubnets"
- "ec2:RunInstances"
- "ec2:StartInstances"
- "ec2:StopInstances"
- "ec2:CreateVolume"
- "ec2:AttachVolume"
- "ec2:DescribeVolumes"
MapRInstanceProfile:
Type: "AWS::IAM::InstanceProfile"
Properties:
Roles:
-
!Ref MapRInstallerRole
Regards,
Bart