AWS
Connect an AWS account so Portal can run jobs on EC2 instances, spot or on-demand, CPU or GPU.
Warnings and limits
- Spot instances get a 2-minute notice. Portal checkpoints and suspends the job inside it, then waits for you to resume it. On-demand instances get no notice.
- Launches count against your account's regional EC2 vCPU quotas, which are separate for spot and on-demand and for each instance family (standard, G and VT, P). Portal reads them; it never requests an increase.
- When EC2 has no capacity or the quota has no room, Portal keeps trying for up to 5 minutes, then moves to the next offer (4 in all) before the job ends as no capacity.
- AWS Fargate offers run from Portal's public node image. Fargate Spot gives a 2-minute notice.
- After a GPU job's program ends, EC2 takes minutes to terminate the instance (about 6.5 minutes for a g4dn.xlarge). The console reads the run as Finishing with what it waits for,
portal pssaysrunninguntil EC2 confirms, nothing after the program's exit is charged, and a stop sent in that window changes nothing. - Quotes leave out EBS volumes, public IPv4 addresses and data transfer, which AWS bills too.
Connect
The recommended way makes an IAM role in your account that Portal assumes. Nothing that could be replayed is stored:
portal connect aws --from-cliUse --profile P for another AWS CLI profile and --region R for the connection's region (us-east-1 by default). The command:
- asks Portal for an ExternalId bound to your workspace (it is valid 24 hours until used);
- prints every step, and asks before it makes anything;
- creates the role, with a trust policy for Portal's identity and that ExternalId, and attaches Portal's policy;
- tags the region's default VPC so Portal's security groups can be made there, and saves the connection, which Portal then verifies.
To use an IAM user and access key instead, add --keys: the key is sealed on Portal's side and never shown again. You can also enter a role ARN or an access key on the console's Connect page.
What the role allows
The policy allows exactly the calls Portal makes, and only on resources Portal tags:
- start EC2 instances only when they carry the tag
soma:managed=true, from public images, in Portal's own tagged security groups, and with no snapshot attached; - terminate, and read the console output of, tagged instances only;
- read instance types, prices, spot price history, subnets and VPCs, and the EC2 vCPU quotas;
- run AWS Fargate tasks in an ECS cluster named
portal, and write logs only under/soma/; - send spot interruptions through AWS FIS, for
portal interrupttests; - read Cost Explorer, to reconcile Portal's cost estimates with your bill once a day.
It cannot touch instances, volumes or snapshots Portal did not create.
Instances
| Family | GPU | Sizes |
|---|---|---|
| c7i, m7i, r7i | none | large to 8xlarge |
| g4dn | NVIDIA T4 | xlarge to 4xlarge |
| g5 | NVIDIA A10G | xlarge to 4xlarge |
| g6 | NVIDIA L4 | xlarge to 4xlarge |
| g6e | NVIDIA L40S | xlarge to 4xlarge |
| p5 | NVIDIA H100 | 4xlarge |
portal prices shows the offers your connection can take, with spot and on-demand prices.
Spot notices
EC2 posts a spot interruption to the instance 2 minutes before it reclaims it. Portal's node on the instance sees it, and Portal pauses the program at its next safe point, saves a checkpoint and suspends the job. The pool that reclaimed the machine is left out of new placements for 30 minutes. See Spot interruptions and checkpoints.
Quotas and capacity
Before each launch Portal reads the regional vCPU quota the instance counts against and skips instance types the quota has no room for. Instances still shutting down count too. When the quota is smaller than one instance of a type, that type is refused for good; request an increase in the Service Quotas console. See Quotas and capacity.