Security controls in Deadline Cloud
A render farm runs jobs from many people on shared infrastructure. Artists submit scenes, worker hosts run them, and the results land in shared storage. AWS Deadline Cloud gives you a set of controls to decide who can see and change farm resources, what jobs can do while they run, and how workloads stay separate from each other.
Three questions organize the controls:
-
Who can see and manage farm resources? Monitor users with access levels, and IAM policies for the console and API.
-
What can the service, workers, and jobs do on your behalf? The IAM service roles for fleets, worker hosts, queues, and monitors.
-
How are workloads kept separate? Farm and queue structure, operating system users for jobs, and per-queue job attachment buckets.
The following table maps each control to what it governs and where to learn more.
| Control | What it governs | More information |
|---|---|---|
Monitor users and access levels |
Which people can see each farm, queue, and fleet in the monitor, and whether they can view, contribute, manage, or own those resources. Users come from AWS IAM Identity Center (IAM Identity Center). |
Managing users in the Deadline Cloud User Guide |
IAM identity-based policies |
What people and tools with AWS credentials can do with the Deadline Cloud console and API, such as creating farms or submitting jobs from a pipeline. |
|
Service roles |
What Deadline Cloud can do on your behalf. The fleet, worker host, queue, and monitor roles each grant a different part of the service a scoped set of permissions. |
|
Queue operating system user |
The operating system permissions that job processes have on worker hosts. On a customer-managed fleet, give each queue its own OS user. On a service-managed fleet, all jobs run as one service-managed user; separate queues by giving them separate fleets. |
|
Farm and queue structure |
The isolation boundaries between workloads. Farms don't share Deadline Cloud resources with each other, and queues within a farm can be separated by fleet, OS user, and bucket. |
|
Job attachment buckets |
Which Amazon S3 data each queue can read and write through its queue role, bucket, and root prefix. |
|
Encryption keys |
How farm data is encrypted at rest, with an AWS owned key or a customer managed AWS KMS key. |
|
Network controls |
How traffic reaches Deadline Cloud: private connectivity with AWS PrivateLink, and the endpoints to allowlist in restricted networks. |
Access AWS Deadline Cloud using an interface endpoint (AWS PrivateLink), Restricted network environments |
Where to start
Pick the entry point that matches your role:
-
If you administer a studio and want to control which artists see which projects, start with Managing users and the Isolate workloads with farms, fleets, and queues guidance.
-
If you build pipelines that submit jobs or read results, start with Identity-based policy examples for Deadline Cloud and Secure job attachment and software buckets.
-
If you want to control what jobs can access while they run, start with Run jobs as dedicated OS users for OS permissions and Service roles for the queue role that grants AWS permissions.
-
If you run customer-managed fleets, start with Service roles and Secure worker hosts.
