5 ms·
No, Batch's interaction with IAM roles and permission is super weird and not at all documented. It is easy to screw it up.
by Marazan 4y ago
No, Batch's interaction with IAM roles and permission is super weird and not at all documented.
It is easy to screw it up.
- dekhn 4y agoAws batch is a terrible product
- aaaaaaaaata 4y agoAWS is a terrible product, unless you happen to be in specific corners they've bothered to document/make their UI architecture not a horror show.
- OJFord 4y agoWhat I mean is 'yes that's a weird interaction' but, if that's how the AWS service works (however weird) then it's an aws-nuke bug that the ordering isn't correct (to account for that weirdness)? Though 'not at all documented' makes that harder of course. I haven't used it.
- dotancohen 4y agoI've never used AWS Batch but heard only good things about it. If you could elaborate - i.e. warn me - I would very much appreciate it. What should I know before using AWS Batch?
- Marazan 4y agoFirst is the problem as described. If youndelete the ComputeEnvironment Role you can't delete the compute environment itself. If you male a mistake setting up the Batch ComputeEnvironment using cloidformation and it rollbacks then the cloidformation error message is useless (resource failed to stabilise) and no trace is left behind for you to check. Two, Batch needs to use servicelinkedroles. If you create an AWS thing that needs a servicelinkedrole via the console it gets creates for you automatically. If you created via CLI or Cloidformation it does not. So if someone has created a batch env in your account before it will probably be there but if you are setting up in a new account you might have no clue whu things arent working. Compute Environments and JobSpecs that use Fargate are configured differenrly, requiring a extra IAM role, from EC2 batch envs.
- dotancohen 4y agoThank you! You've probably saved me much head scratching down the line.