<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">In practice I have found consolidated
billing nice because it separates charges out by account so you
know whom is using what and how much it costs on a monthly basis
without much hassle from the AWS console. You can share AMIs and
Snapshots between accounts and with CloudFormation you could
pretty easily share a similar architecture between accounts.
Deleting and consolidating accounts is pretty simple in practice.
With Starcluster you just need to adjust the config for a specific
account, Starcluster users from different accounts could not
change attributes associated nor have access to the information of
the other account(s). As Hugh said it all depends on what you
want to do and how trusted your users are that share an AWS
account.<br>
<br>
Good Luck,<br>
<br>
-Jennifer<br>
<br>
On 11/13/14 10:18 AM, MacMullan, Hugh wrote:<br>
</div>
<blockquote
cite="mid:C35D2A9F0F1DBE47832D25035CA02DAB379EFEA5@GENO3.wharton.upenn.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">It
really depends on what you're looking to do. Are these
PAYING CUSTOMERS who you MUST (contractually) keep apart? Or
are they members of a team and you just want them to keep
from accidentally hurting each other? You'll have to work
throught the ramifications of the answers to these questions
yourself, and probably learn about IAM User in the process.
I DON'T use IAM User generally, except in a casual "team"
world, so can't really answer your question in any detailed
way.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Good
luck,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Hugh<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">
Ramon Ramirez-Linan [<a class="moz-txt-link-freetext" href="mailto:rlinan@navteca.com">mailto:rlinan@navteca.com</a>]
<br>
<b>Sent:</b> Thursday, November 13, 2014 10:10 AM<br>
<b>To:</b> MacMullan, Hugh<br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:starcluster@mit.edu">starcluster@mit.edu</a><br>
<b>Subject:</b> Re: [StarCluster] User security<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">We only have the option of using the
separate IAM users.<o:p></o:p></p>
<div>
<p class="MsoNormal">What is a good way of doing it? Limit
access to EC2 based on tags? or what other options ?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ramon<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Nov 12, 2014 at 5:38 PM,
MacMullan, Hugh <<a moz-do-not-send="true"
href="mailto:hughmac@wharton.upenn.edu" target="_blank">hughmac@wharton.upenn.edu</a>>
wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC
1.0pt;padding:0in 0in 0in
6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Separate IAM User accounts, or
separate AWS accounts with Consolidated Billing are good
approaches.<br>
<br>
-Hugh<br>
<br>
> On Nov 12, 2014, at 17:21, "Ramon Ramirez-Linan"
<<a moz-do-not-send="true"
href="mailto:rlinan@navteca.com">rlinan@navteca.com</a>>
wrote:<br>
><br>
> Hello,<br>
><br>
> What is the best way to implement security between
the users so they can not stop each others clusters
(stop, detroy see, etc)<br>
><br>
> I am having the issue that when any user run
starcluster listclusters they see all the clusters
currently running on the AWS account.<br>
><br>
> Also I am curious about how starclusters find the
information of current running clusters<br>
><br>
> Thanks<br>
><br>
> Ramon<br>
> _______________________________________________<br>
> StarCluster mailing list<br>
> <a moz-do-not-send="true"
href="mailto:StarCluster@mit.edu">StarCluster@mit.edu</a><br>
> <a moz-do-not-send="true"
href="http://mailman.mit.edu/mailman/listinfo/starcluster"
target="_blank">http://mailman.mit.edu/mailman/listinfo/starcluster</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
StarCluster mailing list
<a class="moz-txt-link-abbreviated" href="mailto:StarCluster@mit.edu">StarCluster@mit.edu</a>
<a class="moz-txt-link-freetext" href="http://mailman.mit.edu/mailman/listinfo/starcluster">http://mailman.mit.edu/mailman/listinfo/starcluster</a>
</pre>
</blockquote>
<br>
</body>
</html>