feat(deadline): change SEP construct to use launch templates instead …

…of launch specifications (#513)

* feat(deadline): change SEP construct to use launch templates instead of launch specifications

BREAKING CHANGE: SpotEventPluginFleet now uses EC2 Launch Templates instead of Launch Specifications.
See the [RFDK 0.39.x upgrade documentation](https://github.com/aws/aws-rfdk/blob/v0.39.0/packages/aws-rfdk/docs/upgrade/upgrading-0.39.md)
for more details and guidance on how to upgrade.

* update example app flag description, correct subnet ID code, and general cleanup

* update render queue SEP policy

* add upgrade documentation and general cleanup

* update architecture diagram for SpotEventPluginFleet

examples/deadline/All-In-AWS-Infrastructure-SEP/python/package/app.py

@@ -45,6 +45,7 @@ def main():
     sep_props = sep_stack.SEPStackProps(
         docker_recipes_stage_path=os.path.join(os.path.dirname(os.path.realpath(__file__)), os.pardir, 'stage'),
         worker_machine_image=MachineImage.generic_linux(config.deadline_client_linux_ami_map),
+        create_resource_tracker_role=config.create_resource_tracker_role,
     )
     service = sep_stack.SEPStack(app, 'SEPStack', props=sep_props, env=env)
 

examples/deadline/All-In-AWS-Infrastructure-SEP/python/package/config.py

@@ -19,5 +19,13 @@ def __init__(self):
         #  should match the one used for staging the render queue and usage based licensing recipes.
         self.deadline_client_linux_ami_map: Mapping[str, str] = {'us-west-2': 'ami-04ae356533dc07fb5'}
 
+        # Whether the DeadlineResourceTrackerAccessRole IAM role required by Deadline's Resource Tracker should be created in this CDK app.
+        #
+        # If you have previously used this same AWS account with either Deadline's AWS Portal feature or Spot Event Plugin and had used the
+        # Deadline Resource Tracker, then you likely have this IAM role in your account already unless you have removed it.
+        #
+        # Note: Deadline's Resource Tracker only supports being used by a single Deadline Repository per AWS account.
+        self.create_resource_tracker_role: bool = True
+
 
 config: AppConfig = AppConfig()

examples/deadline/All-In-AWS-Infrastructure-SEP/python/package/lib/sep_stack.py

@@ -60,6 +60,8 @@ class SEPStackProps(StackProps):
     docker_recipes_stage_path: str
     # The IMachineImage to use for Workers (needs Deadline Client installed).
     worker_machine_image: IMachineImage
+    # Whether the DeadlineResourceTrackerAccessRole IAM role required by Deadline's Resource Tracker should be created in this CDK app.
+    create_resource_tracker_role: bool
 
 
 class SEPStack(Stack):
@@ -159,15 +161,15 @@ def __init__(self, scope: Construct, stack_id: str, *, props: SEPStackProps, **k
             ),
         )
 
-        # Creates the Resource Tracker Access role. This role is required to exist in your account so the resource tracker will work properly
-        # Note: If you already have a Resource Tracker IAM role in your account you can remove this code.
-        Role(
-            self,
-            'ResourceTrackerRole',
-            assumed_by=ServicePrincipal('lambda.amazonaws.com'),
-            managed_policies= [ManagedPolicy.from_aws_managed_policy_name('AWSThinkboxDeadlineResourceTrackerAccessPolicy')],
-            role_name= 'DeadlineResourceTrackerAccessRole',
-        )
+        if props.create_resource_tracker_role:
+            # Creates the Resource Tracker Access role. This role is required to exist in your account so the resource tracker will work properly
+            Role(
+                self,
+                'ResourceTrackerRole',
+                assumed_by=ServicePrincipal('lambda.amazonaws.com'),
+                managed_policies= [ManagedPolicy.from_aws_managed_policy_name('AWSThinkboxDeadlineResourceTrackerAccessPolicy')],
+                role_name= 'DeadlineResourceTrackerAccessRole',
+            )
 
         fleet = SpotEventPluginFleet(
             self,

examples/deadline/All-In-AWS-Infrastructure-SEP/ts/bin/app.ts

@@ -36,4 +36,5 @@ new SEPStack(app, 'SEPStack', {
   env,
   dockerRecipesStagePath: path.join(__dirname, '..', pkg.config.stage_path), // Stage directory in config is relative, make it absolute
   workerMachineImage: MachineImage.genericLinux(config.deadlineClientLinuxAmiMap),
+  createResourceTrackerRole: config.createResourceTrackerRole,
 });

examples/deadline/All-In-AWS-Infrastructure-SEP/ts/bin/config.ts

@@ -16,6 +16,16 @@ class AppConfig {
    * is filled in. It can be used as-is, added to, or replaced.
    */
   public readonly deadlineClientLinuxAmiMap: Record<string, string> = {['us-west-2']: 'ami-04ae356533dc07fb5'};
+
+  /**
+   * Whether the DeadlineResourceTrackerAccessRole IAM role required by Deadline's Resource Tracker should be created in this CDK app.
+   *
+   * If you have previously used this same AWS account with either Deadline's AWS Portal feature or Spot Event Plugin and had used the
+   * Deadline Resource Tracker, then you likely have this IAM role in your account already unless you have removed it.
+   *
+   * Note: Deadline's Resource Tracker only supports being used by a single Deadline Repository per AWS account.
+   */
+  public readonly createResourceTrackerRole: boolean = true;
 }
 
 export const config = new AppConfig();

examples/deadline/All-In-AWS-Infrastructure-SEP/ts/lib/sep-stack.ts

@@ -49,6 +49,11 @@ export interface SEPStackProps extends StackProps {
    * The {@link IMachineImage} to use for Workers (needs Deadline Client installed).
    */
   readonly workerMachineImage: IMachineImage;
+
+  /**
+   * Whether the DeadlineResourceTracker stack and supporting resources already exist or not.
+   */
+  readonly createResourceTrackerRole: boolean;
 }
 
 export class SEPStack extends Stack {
@@ -126,15 +131,16 @@ export class SEPStack extends Stack {
       trafficEncryption,
     });
 
-    // Creates the Resource Tracker Access role. This role is required to exist in your account so the resource tracker will work properly
-    // Note: If you already have a Resource Tracker IAM role in your account you can remove this code.
-    new Role(this, 'ResourceTrackerRole', {
-      assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
-      managedPolicies: [
-        ManagedPolicy.fromAwsManagedPolicyName('AWSThinkboxDeadlineResourceTrackerAccessPolicy'),
-      ],
-      roleName: 'DeadlineResourceTrackerAccessRole',
-    });
+    if (props.createResourceTrackerRole) {
+      // Creates the Resource Tracker Access role. This role is required to exist in your account so the resource tracker will work properly
+      new Role(this, 'ResourceTrackerRole', {
+        assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
+        managedPolicies: [
+          ManagedPolicy.fromAwsManagedPolicyName('AWSThinkboxDeadlineResourceTrackerAccessPolicy'),
+        ],
+        roleName: 'DeadlineResourceTrackerAccessRole',
+      });
+    }
 
     const fleet = new SpotEventPluginFleet(this, 'SpotEventPluginFleet', {
       vpc,
@@ -154,7 +160,7 @@ export class SEPStack extends Stack {
 
     new ConfigureSpotEventPlugin(this, 'ConfigureSpotEventPlugin', {
       vpc,
-      renderQueue: renderQueue,
+      renderQueue,
       spotFleets: [
         fleet,
       ],

packages/aws-rfdk/docs/upgrade/index.md

@@ -7,3 +7,4 @@ upgrading to (or beyond) a version listed below, you should consult the the link
 *   [`0.27.x`](./upgrading-0.27.md)
 *   [`0.37.x`](./upgrading-0.37.md)
 *   [`0.38.x`](./upgrading-0.38.md)
+*   [`0.39.x`](./upgrading-0.39.md)

packages/aws-rfdk/docs/upgrade/upgrading-0.39.md

@@ -0,0 +1,13 @@
+# Upgrading to RFDK v0.39.x or Newer
+
+Starting in RFDK v0.39.0, the `SpotEventPluginFleet` construct now creates an [EC2 Launch Template](https://docs.aws.amazon.com/autoscaling/ec2/userguide/LaunchTemplates.html)
+instead of using Launch Specifications. This change will reconfigure the Spot Event Plugin settings in Deadline to use a new Spot Fleet Request configuration. If you have active
+Spot Fleet Requests created by the Spot Event Plugin, upgrading to RFDK v0.39.x and redeploying your render farm will orphan those Spot Fleet Requests. Therefore, we highly
+recommend following these instructions to upgrade to RFDK v0.39.x:
+
+1. Disable the Spot Event Plugin in Deadline. Refer to the [Spot Event Plugin "State" option in Deadline](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/event-spot-configuration-options.html)
+for more information.
+2. Cancel any Spot Fleet Requests created by the Spot Event Plugin, which you can do by following these [instructions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/work-with-spot-fleets.html#cancel-spot-fleet).
+3. Upgrade to RFDK v0.39.x and redeploy your render farm.
+4. Once the deployment is complete, re-enable the Spot Event Plugin in Deadline. Refer to the [Spot Event Plugin "State" option in Deadline](https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/event-spot-configuration-options.html)
+for more information.

packages/aws-rfdk/lib/deadline/lib/configure-spot-event-plugin.ts

@@ -5,10 +5,6 @@
 
 import * as path from 'path';
 
-import {
-  BlockDevice,
-  BlockDeviceVolume,
-} from '@aws-cdk/aws-autoscaling';
 import {
   IVpc,
   SubnetSelection,
@@ -30,7 +26,6 @@ import {
   Construct,
   CustomResource,
   Duration,
-  Fn,
   IResolvable,
   Lazy,
   Stack,
@@ -39,13 +34,9 @@ import {
 import {
   PluginSettings,
   SEPConfiguratorResourceProps,
-  LaunchSpecification,
   SpotFleetRequestConfiguration,
   SpotFleetRequestProps,
-  SpotFleetSecurityGroupId,
   SpotFleetTagSpecification,
-  BlockDeviceMappingProperty,
-  BlockDeviceProperty,
 } from '../../lambdas/nodejs/configure-spot-event-plugin';
 import {
   IRenderQueue,
@@ -157,6 +148,12 @@ export interface SpotEventPluginSettings {
 
   /**
    * Determines whether the Deadline Resource Tracker should be used.
+   *
+   * In addition to this property, the Spot Instances deployed by the Spot Event Plugin must also be configured to be tracked by the Resource Tracker using the
+   * [`trackInstancesWithResourceTracker`](https://docs.aws.amazon.com/rfdk/api/latest/docs/aws-rfdk.deadline.SpotEventPluginFleet.html#trackinstanceswithresourcetracker)
+   * property of the `SpotEventPluginFleet` construct, which is `true` by default. You can set that property to `false` for fleets that you would like to opt out of the
+   * Resource Tracker.
+   *
    * See https://docs.thinkboxsoftware.com/products/deadline/10.1/1_User%20Manual/manual/resource-tracker-overview.html
    *
    * @default true
@@ -344,6 +341,9 @@ export interface ConfigureSpotEventPluginProps {
  *  - A policy to pass a fleet and instance role
  *  - A policy to create tags for spot fleet requests
  *
+ * The Spot Fleet Requests that this construct configures Deadline to create will always use the latest version of the
+ * corresponding EC2 Launch Template that was created for them.
+ *
  * ![architecture diagram](/diagrams/deadline/ConfigureSpotEventPlugin.svg)
  *
  * Resources Deployed
@@ -352,6 +352,7 @@ export interface ConfigureSpotEventPluginProps {
  * - A CloudFormation Custom Resource that triggers execution of the Lambda on stack deployment, update, and deletion.
  * - An Amazon CloudWatch log group that records history of the AWS Lambda's execution.
  * - An IAM Policy attached to Render Queue's Role.
+ * - EC2 Launch Templates for each Spot Event Plugin fleet.
  *
  * Security Considerations
  * ------------------------
@@ -418,7 +419,10 @@ export class ConfigureSpotEventPlugin extends Construct {
               actions: [
                 'ec2:CreateTags',
               ],
-              resources: ['arn:aws:ec2:*:*:spot-fleet-request/*'],
+              resources: [
+                'arn:aws:ec2:*:*:spot-fleet-request/*',
+                'arn:aws:ec2:*:*:volume/*',
+              ],
             }),
           ],
           roles: [
@@ -545,54 +549,15 @@ export class ConfigureSpotEventPlugin extends Construct {
 
   /**
    * Construct Spot Fleet Configurations from the provided fleet.
-   * Each congiguration is a mapping between one Deadline Group and one Spot Fleet Request Configuration.
+   * Each configuration is a mapping between one Deadline Group and one Spot Fleet Request Configuration.
    */
   private generateSpotFleetRequestConfig(fleet: SpotEventPluginFleet): SpotFleetRequestConfiguration[] {
-    const securityGroupsToken = Lazy.any({ produce: () => {
-      return fleet.securityGroups.map(sg => {
-        const securityGroupId: SpotFleetSecurityGroupId = {
-          GroupId: sg.securityGroupId,
-        };
-        return securityGroupId;
-      });
-    }});
-
-    const userDataToken = Lazy.string({ produce: () => Fn.base64(fleet.userData.render()) });
-
-    const blockDeviceMappings = (fleet.blockDevices !== undefined ?
-      this.synthesizeBlockDeviceMappings(fleet.blockDevices) : undefined);
-
-    const { subnetIds } = fleet.subnets;
-    const subnetId = subnetIds.join(',');
-
-    const instanceTagsToken = this.tagSpecifications(fleet, SpotFleetResourceType.INSTANCE);
     const spotFleetRequestTagsToken = this.tagSpecifications(fleet, SpotFleetResourceType.SPOT_FLEET_REQUEST);
 
-    const launchSpecifications: LaunchSpecification[] = [];
-
-    fleet.instanceTypes.map(instanceType => {
-      const launchSpecification: LaunchSpecification = {
-        BlockDeviceMappings: blockDeviceMappings,
-        IamInstanceProfile: {
-          Arn: fleet.instanceProfile.attrArn,
-        },
-        ImageId: fleet.imageId,
-        KeyName: fleet.keyName,
-        // Need to convert from IResolvable to bypass TypeScript
-        SecurityGroups: (securityGroupsToken  as unknown) as SpotFleetSecurityGroupId[],
-        SubnetId: subnetId,
-        // Need to convert from IResolvable to bypass TypeScript
-        TagSpecifications: (instanceTagsToken as unknown) as SpotFleetTagSpecification[],
-        UserData: userDataToken,
-        InstanceType: instanceType.toString(),
-      };
-      launchSpecifications.push(launchSpecification);
-    });
-
     const spotFleetRequestProps: SpotFleetRequestProps = {
       AllocationStrategy: fleet.allocationStrategy,
       IamFleetRole: fleet.fleetRole.roleArn,
-      LaunchSpecifications: launchSpecifications,
+      LaunchTemplateConfigs: fleet._launchTemplateConfigs,
       ReplaceUnhealthyInstances: true,
       // In order to work with Deadline, the 'Target Capacity' of the Spot fleet Request is
       // the maximum number of Workers that Deadline will start.
@@ -615,49 +580,6 @@ export class ConfigureSpotEventPlugin extends Construct {
     return spotFleetRequestConfigurations;
   }
 
-  /**
-   * Synthesize an array of block device mappings from a list of block devices
-   *
-   * @param blockDevices list of block devices
-   */
-  private synthesizeBlockDeviceMappings(blockDevices: BlockDevice[]): BlockDeviceMappingProperty[] {
-    return blockDevices.map(({ deviceName, volume, mappingEnabled }) => {
-      const { virtualName, ebsDevice: ebs } = volume;
-
-      if (volume === BlockDeviceVolume._NO_DEVICE || mappingEnabled === false) {
-        return {
-          DeviceName: deviceName,
-          // To omit the device from the block device mapping, specify an empty string.
-          // See https://docs.aws.amazon.com/cli/latest/reference/ec2/request-spot-fleet.html
-          NoDevice: '',
-        };
-      }
-
-      let Ebs: BlockDeviceProperty | undefined;
-
-      if (ebs) {
-        const { iops, volumeType, volumeSize, snapshotId, deleteOnTermination } = ebs;
-
-        Ebs = {
-          DeleteOnTermination: deleteOnTermination,
-          Iops: iops,
-          SnapshotId: snapshotId,
-          VolumeSize: volumeSize,
-          VolumeType: volumeType,
-          // encrypted is not exposed as part of ebsDeviceProps so we need to access it via [].
-          // eslint-disable-next-line dot-notation
-          Encrypted: 'encrypted' in ebs ? ebs['encrypted'] : undefined,
-        };
-      }
-
-      return {
-        DeviceName: deviceName,
-        Ebs,
-        VirtualName: virtualName,
-      };
-    });
-  }
-
   private mergeSpotFleetRequestConfigs(spotFleets?: SpotEventPluginFleet[]): SpotFleetRequestConfiguration | undefined {
     if (!spotFleets || spotFleets.length === 0) {
       return undefined;