fix(deadline): allow traffic from RenderQueue to UsageBasedLicensing

[jusiskin]

Problem

When rendering jobs with Deadline Third-Party Usage Based Licensing (UBL) with a fleet of 50 workers, the API endpoints served by the RenderQueue construct become locked-up and eventually return 503 Service Unavailable responses. The health checks on the Application Load Balancer detect this problem and signal to ECS to replace the task - causing a render farm disruption.

Solution

It was determined that the RCS request handlers were blocked attempting to communicate with the Deadline License Forwarder deployed by the UsageBasedLicensing construct. It was discovered that RFDK does not create a security group rule to allow this traffic from the RenderQueue → UsageBasedLicensing. The Deadline Remote Connection Server uses a long connection timeout and with a sufficiently large number of workers rendering jobs, the request handling threads become blocked waiting for these connections to time out.

The solution is to add a security group rule when creating a UsageBasedLicensing construct instance to allow this traffic and avoid connection timeouts.

Testing

• Synthesis tests were added to cover this behavior
• The AWS-All-In-Infrastructure-Basic example app was configured to use UBL. It deployed successfully and all RenderQueue performance degradations and disruptions disappeared

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[ddneilson]

Nice work tracking this one down, Josh!

LGTM