Create a Spot Fleet

To create a policy for Spot Fleet

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Policies, Create policy.

3. On the Create policy page, choose JSON, and replace the text with the following.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:RunInstances",
                   "ec2:CreateTags",
                   "ec2:RequestSpotFleet",
                   "ec2:ModifySpotFleetRequest",
                   "ec2:CancelSpotFleetRequests",
                   "ec2:DescribeSpotFleetRequests",
                   "ec2:DescribeSpotFleetInstances",
                   "ec2:DescribeSpotFleetRequestHistory"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "iam:PassRole",
               "Resource": "arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "iam:CreateServiceLinkedRole",
                   "iam:ListRoles",
                   "iam:ListInstanceProfiles"
               ],
               "Resource": "*"
           }
       ]
   }

   The preceding example policy grants a user the permissions required for most Spot Fleet use cases. To limit the user to specific API actions, specify only those API actions instead.

   Required EC2 and IAM APIs

   The following APIs must be included in the policy:

   • ec2:RunInstances – Required to launch instances in a Spot Fleet

   • ec2:CreateTags – Required to tag the Spot Fleet request, instances, or volumes

   • iam:PassRole – Required to specify the Spot Fleet role

   • iam:CreateServiceLinkedRole – Required to create the service-linked role

   • iam:ListRoles – Required to enumerate existing IAM roles

   • iam:ListInstanceProfiles – Required to enumerate existing instance profiles

   Important

   If you specify a role for the IAM instance profile in the launch specification or launch template, you must grant the user the permission to pass the role to the service. To do this, in the IAM policy include "arn:aws:iam::*:role/IamInstanceProfile-role" as a resource for the iam:PassRole action. For more information, see Granting a user permissions to pass a role to an AWS service in the IAM User Guide.

   Spot Fleet APIs

   Add the following Spot Fleet API actions to your policy, as needed:

   • ec2:RequestSpotFleet

   • ec2:ModifySpotFleetRequest

   • ec2:CancelSpotFleetRequests

   • ec2:DescribeSpotFleetRequests

   • ec2:DescribeSpotFleetInstances

   • ec2:DescribeSpotFleetRequestHistory

   Optional IAM APIs

   (Optional) To enable a user to create roles or instance profiles using the IAM console, you must add the following actions to the policy:

   • iam:AddRoleToInstanceProfile

   • iam:AttachRolePolicy

   • iam:CreateInstanceProfile

   • iam:CreateRole

   • iam:GetRole

   • iam:ListPolicies

4. Choose Review policy.

5. On the Review policy page, enter a policy name and description, and choose Create policy.

6. To provide access, add permissions to your users, groups, or roles:

   • Users and groups in AWS IAM Identity Center:

     Create a permission set. Follow the instructions in Create a permission set in the AWS IAM Identity Center User Guide.

   • Users managed in IAM through an identity provider:

     Create a role for identity federation. Follow the instructions in Create a role for a third-party identity provider (federation) in the IAM User Guide.

   • IAM users:

     • Create a role that your user can assume. Follow the instructions in Create a role for an IAM user in the IAM User Guide.

     • (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in Adding permissions to a user (console) in the IAM User Guide.

To create the AWSServiceRoleForEC2SpotFleet role for Spot Fleet using the console

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Roles.

3. Choose Create role.

4. On the Select trusted entity page, do the following:

   1. For Trusted entity type, choose AWS service.

   2. Under Use case, for Service or use case, choose EC2.

   3. For Use case, choose EC2 - Spot Fleet.

      Note

      The EC2 - Spot Fleet use case will automatically create a policy with the required IAM permissions and will suggest AWSEC2SpotFleetServiceRolePolicy as the role name.

   4. Choose Next.

5. On the Add permissions page, choose Next.

6. On the Name, review, and create page, choose Create role.

To grant the AWSServiceRoleForEC2SpotFleet role permissions to use the CMK

• Use the create-grant command to add a grant to the CMK and to specify the principal (the AWSServiceRoleForEC2SpotFleet service-linked role) that is given permission to perform the operations that the grant permits. The CMK is specified by the key-id parameter and the ARN of the CMK. The principal is specified by the grantee-principal parameter and the ARN of the AWSServiceRoleForEC2SpotFleet service-linked role.

  aws kms create-grant \
      --region us-east-1 \
      --key-id arn:aws:kms:us-east-1:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab \
      --grantee-principal arn:aws:iam::111122223333:role/AWSServiceRoleForEC2SpotFleet \
      --operations "Decrypt" "Encrypt" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "CreateGrant" "DescribeKey" "ReEncryptFrom" "ReEncryptTo"

To create the IAM role for tagging a Spot Fleet

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Roles.

3. Choose Create role.

4. On the Select trusted entity page, under Trusted entity type, choose AWS service.

5. Under Use case, from Use cases for other AWS services, choose EC2, and then choose EC2 - Spot Fleet Tagging.

6. Choose Next.

7. On the Add permissions page, choose Next.

8. On the Name, review, and create page, for Role name, enter a name for the role (for example, aws-ec2-spot-fleet-tagging-role).

9. Review the information on the page, and then choose Create role.

To add the aws:SourceArn and aws:SourceAccount condition keys to the aws-ec2-spot-fleet-tagging-role trust policy

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Roles.

3. Find the aws-ec2-spot-fleet-tagging-role that you created previously and choose the link (not the checkbox).

4. Under Summary, choose the Trust relationships tab, and then choose Edit trust policy.

5. In the JSON statement, add a Condition element containing your aws:SourceAccount and aws:SourceArn global condition context keys to prevent the confused deputy problem, as follows:

   "Condition": {
         "ArnLike": {
           "aws:SourceArn": "arn:aws:ec2:us-east-1:account_id:spot-fleet-request/sfr-*"
         },
         "StringEquals": {
           "aws:SourceAccount": "account_id"
         }

   Note

   If the aws:SourceArn value contains the account ID and you use both global condition context keys, the aws:SourceAccount value and the account in the aws:SourceArn value must use the same account ID when used in the same policy statement.

   The final trust policy will be as follows:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Sid": "ConfusedDeputyPreventionExamplePolicy",
       "Effect": "Allow",
       "Principal": {
         "Service": "spotfleet.amazonaws.com"
       },
       "Action": "sts:AssumeRole",
       "Condition": {
         "ArnLike": {
           "aws:SourceArn": "arn:aws:ec2:us-east-1:account_id:spot-fleet-request/sfr-*"
         },
         "StringEquals": {
           "aws:SourceAccount": "account_id"
         }
       }
     }
   }

6. Choose Update policy.

To create a Spot Fleet request using the recommended settings (console)

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Spot Requests.

3. If you are new to Spot, you see a welcome page; choose Get started. Otherwise, choose Request Spot Instances.

4. Under Launch parameters, choose Manually configure launch parameters.

5. For AMI, choose an AMI.

6. Under Target capacity, for Total target capacity, specify the number of units to request. For the type of unit, you can choose Instances, vCPUs, or Memory (GiB).

7. For Your fleet request at a glance, review your fleet configuration, and choose Launch.

To create a Spot Fleet request using defined parameters (console)

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Spot Requests.

3. If you are new to Spot, you see a welcome page; choose Get started. Otherwise, choose Request Spot Instances.

4. For Launch parameters, you can either manually configure the launch parameters or you can use a launch template, as follows:

   1. [Manually configure] To define the launch parameters in the Amazon EC2 console, choose Manually configure launch parameters, and then do the following:

      1. For AMI, choose one of the basic AMIs provided by AWS, or choose Search for AMI to use an AMI from our user community, the AWS Marketplace, or one of your own.

         Note

         If an AMI specified in the launch parameters is deregistered or disabled, no new instances can be launched from the AMI. For fleets that are set to maintain target capacity, the target capacity will not be maintained.

      2. (Optional) For Key pair name, choose an existing key pair or create a new one.

         [Existing key pair] Choose the key pair.

         [New key pair] Choose Create new key pair to go the Key pairs page. When you are done, return to the Spot Requests page and refresh the list.

      3. (Optional) Expand Additional launch parameters, and do the following:

         1. (Optional) To enable Amazon EBS optimization, for EBS-optimized, select Launch EBS-optimized instances.

         2. (Optional) To add temporary block-level storage for your instances, for Instance store, choose Attach at launch.

         3. (Optional) To add storage, choose Add new volume, and specify additional instance store volumes or Amazon EBS volumes, depending on the instance type.

         4. (Optional) By default, basic monitoring is enabled for your instances. To enable detailed monitoring, for Monitoring, select Enable CloudWatch detailed monitoring.

         5. (Optional) To run a Dedicated Spot Instance, for Tenancy, choose Dedicated - run a dedicated instance.

         6. (Optional) For Security groups, choose one or more security groups or create a new one.

            [Existing security group] Choose one or more security groups.

            [New security group] Choose Create new security group to go the Security Groups page. When you are done, return to the Spot Requests and refresh the list.

         7. (Optional) To make your instances reachable from the internet, for Auto-assign IPv4 Public IP, choose Enable.

         8. (Optional) To launch your Spot Instances with an IAM role, for IAM instance profile, choose the role.

         9. (Optional) To run a start-up script, copy it to User data.

         10. (Optional) To add a tag, choose Create tag and enter the key and value for the tag, and choose Create. Repeat for each tag.

             For each tag, to tag the instances and the Spot Fleet request with the same tag, ensure that both Instances and Fleet are selected. To tag only the instances launched by the fleet, clear Fleet. To tag only the Spot Fleet request, clear Instances.

   2. [Launch template] To use a configuration you created in a launch template, choose Use a launch template, and for Launch template, choose a launch template.

      Note

      If you want On-Demand capacity in your Spot Fleet, you must specify a launch template.

5. For Additional request details, do the following:

   1. Review the additional request details. To make changes, clear Apply defaults.

   2. (Optional) For IAM fleet role, you can use the default role or choose a different role. To use the default role after changing the role, choose Use default role.

   3. (Optional) To create a request that is valid only during a specific time period, edit Request valid from and Request valid until.

   4. (Optional) By default, Amazon EC2 terminates your Spot Instances when the Spot Fleet request expires. To keep them running after your request expires, clear Terminate the instances when the request expires.

   5. (Optional) To register your Spot Instances with a load balancer, choose Receive traffic from one or more load balancers and choose one or more Classic Load Balancers or target groups.

6. For Target capacity, do the following:

   1. For Total target capacity, specify the number of units to request. For the type of unit, you can choose Instances, vCPUs, or Memory (MiB). To specify a target capacity of 0 so that you can add capacity later, you must first select Maintain target capacity.

   2. (Optional) For Include On-Demand base capacity, specify the number of On-Demand units to request. The number must be less than the Total target capacity. Amazon EC2 calculates the difference, and allocates the difference to Spot units to request.

      Important

      To specify optional On-Demand capacity, you must first choose a launch template.

   3. (Optional) By default, Amazon EC2 terminates Spot Instances when they are interrupted. To maintain the target capacity, select Maintain target capacity. You can then specify that Amazon EC2 terminates, stops, or hibernates Spot Instances when they are interrupted. To do so, choose the corresponding option from Interruption behavior.

      Note

      If an AMI specified in the launch parameters is deregistered or disabled, no new instances can be launched from the AMI. In this case, for fleets that are set to maintain target capacity, the target capacity will not be maintained.

   4. (Optional) To allow Spot Fleet to launch a replacement Spot Instance when an instance rebalance notification is emitted for an existing Spot Instance in the fleet, select Capacity rebalance, and then choose an instance replacement strategy. If you choose Launch before terminate, specify the delay (in seconds) before Amazon EC2 terminates the old instances. For more information, see Use Capacity Rebalancing in EC2 Fleet and Spot Fleet to replace at-risk Spot Instances.

   5. (Optional) To control the amount you pay per hour for all the Spot Instances in your fleet, select Set maximum cost for Spot Instances and then enter the maximum total amount you're willing to pay per hour. When the maximum total amount is reached, Spot Fleet stops launching Spot Instances even if it hasn’t met the target capacity. For more information, see Set a spending limit for your EC2 Fleet or Spot Fleet.

7. For Network, do the following:

   1. For Network, choose an existing VPC or create a new one.

      [Existing VPC] Choose the VPC.

      [New VPC] Choose Create new VPC to go the Amazon VPC console. When you're done, return to this screen and refresh the list.

   2. (Optional) For Availability Zone, let Amazon EC2 choose the Availability Zones for your Spot Instances, or specify one or more Availability Zones.

      If you have more than one subnet in an Availability Zone, choose the appropriate subnet from Subnet. To add subnets, choose Create new subnet to go to the Amazon VPC console. When you are done, return to this screen and refresh the list.

8. For Instance type requirements, you can either specify instance attributes and let Amazon EC2 identify the optimal instance types with these attributes, or you can specify a list of instances. For more information, see Specify attributes for instance type selection for EC2 Fleet or Spot Fleet.

   1. If you choose Specify instance attributes that match your compute requirements, specify your instance attributes as follows:

      1. For vCPUs, enter the desired minimum and maximum number of vCPUs. To specify no limit, select No minimum or No maximum, or both.

      2. For Memory (GiB), enter the desired minimum and maximum amount of memory. To specify no limit, select No minimum or No maximum, or both.

      3. (Optional) For Additional instance attribute, you can optionally specify one or more attributes to express your compute requirements in more detail. Each additional attribute adds a further constraint to your request. You can omit the additional attributes; when omitted, the default values are used. For a description of each attribute and their default values, see get-spot-placement-scores in the Amazon EC2 Command Line Reference.

      4. (Optional) To view the instance types with your specified attributes, expand Preview matching instance types. To exclude instance types from being used in your request, select the instances and then choose Exclude selected instance types.

   2. If you choose Manually select instance types, Spot Fleet provides a default list of instance types. To select more instance types, choose Add instance types, select the instance types to use in your request, and choose Select. To delete instance types, select the instance types and choose Delete.

9. For Allocation strategy, choose a Spot allocation strategy and an On-Demand allocation strategy that meets your needs. For more information, see Use allocation strategies to determine how EC2 Fleet or Spot Fleet fulfills Spot and On-Demand capacity.

10. For Your fleet request at a glance, review your fleet configuration, and make any adjustments if necessary.

11. (Optional) To download a copy of the launch configuration for use with the AWS CLI, choose JSON config.

12. When you're ready to launch your Spot Fleet, choose Launch.

    The Spot Fleet request type is fleet. When the request is fulfilled, requests of type instance are added, where the state is active and the status is fulfilled.