Use AWS-maintained scripts for node lifecycle actions in AWS PCS

AWS publishes maintained scripts for common lifecycle actions. You reference a maintained script directly from your compute node group configuration. The scripts are idempotent and safe to run on every boot.

AWS distributes the scripts from a public, AWS-managed Amazon S3 bucket in each AWS Region. You reference a script by its Amazon S3 URI. You reference a maintained script the same way you reference your own script. You can reference the scripts directly from the AWS-managed bucket.

Available scripts

Reference a script

Reference a script by its Amazon S3 URI in the scriptLocation field of a lifecycle action. The scripts are stored under the aws-pcs-node-lifecycle-scripts prefix of the AWS-managed aws-pcs-repo-region bucket in each AWS Region. Use the bucket in the same AWS Region as your cluster.

s3://aws-pcs-repo-region/aws-pcs-node-lifecycle-scripts/script-vversion.sh

Each script is versioned with semantic versioning. You can pin a specific version or track the latest release within a major version:

Every script has a companion SHA-256 checksum file at the same location with a .sha256 suffix (for example, mount-efs-v1.0.0.sh.sha256). Read the .sha256 value and set it as the script's checksum. The agent then verifies the script's integrity on download. For more information, see Script integrity (checksums).

Available script versions

AWS versions each script independently. The following tables list the available versions of each script. Use a version in the script's Amazon S3 URI, as described in Reference a script.

mount-efs.sh

mount-fsx-lustre.sh

configure-efs-homes.sh

configure-ldaps.sh

configure-cloudwatch-logs.sh

Example: Mount an EFS file system with a maintained script

The following example references the maintained mount-efs.sh script in the us-west-2 AWS Region. You pass arguments as named flags. For the script's arguments, see Script arguments.

aws pcs update-compute-node-group \
  --cluster-identifier my-cluster \
  --compute-node-group-identifier my-cng \
  --node-lifecycle-actions '{
    "stages": {
      "nodeBootstrapped": [
        {
          "name": "Mount EFS home directory",
          "scriptSource": {
            "scriptLocation": "s3://aws-pcs-repo-us-west-2/aws-pcs-node-lifecycle-scripts/mount-efs-v1.0.0.sh"
          },
          "arguments": ["--file-system-id", "fs-12345678", "--mount-point", "/shared"],
          "onError": "TERMINATE",
          "executionPolicy": "EVERY_BOOT"
        }
      ]
    }
  }'

The node's instance role must have s3:GetObject permission for the script object. Nodes in a private subnet can reach the bucket through an S3 gateway VPC endpoint. For more information, see Script storage locations.

Script arguments

Each script takes named-flag arguments. Pass each flag and its value as separate elements of the arguments array (for example, ["--file-system-id", "fs-12345678"]). All scripts run as root and support the AL2, AL2023, RHEL, Ubuntu, and Rocky Linux operating systems.

mount-efs.sh

With the default iam option, the node's instance role must allow elasticfilesystem:ClientMount and elasticfilesystem:ClientWrite. The node's subnet must have an EFS mount target whose security group allows inbound NFS (TCP 2049) from the node.

mount-fsx-lustre.sh

The node's subnet must reach the file system, and the file system's security group must allow inbound Lustre traffic (TCP 988, and 1018–1023 for clients that use reserved source ports) from the node.

configure-efs-homes.sh

This script requires amazon-efs-utils, nfs-utils, and PAM mkhomedir support. On RHEL-family nodes, install oddjob, oddjob-mkhomedir, and authselect. On AL2023, install authselect explicitly. On Ubuntu, install libpam-modules. IAM and network requirements match mount-efs.sh.

configure-ldaps.sh

This script requires sssd, sssd-ldap, and sssd-tools. On RHEL-family nodes, it also requires authselect or authconfig and oddjob-mkhomedir. On Ubuntu, it requires libpam-modules.

With --secret-arn, the node's instance role must allow secretsmanager:GetSecretValue for the secret, and the node needs the awscli and python3 packages. The secret's value must be JSON of the form {"username": "<bind-dn>", "password": "<bind-password>"}. Anonymous bind makes no AWS API calls and needs no IAM permissions.

configure-cloudwatch-logs.sh

The script forwards the lifecycle action log directory (/var/log/amazon/pcs/lifecycle/actions). The node's instance role must allow logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents on the target log group. Use this script to forward logs off-instance for post-mortem debugging.