ParallelCluster IAM guardrail examples (BioTeam, October 2026)
================================================================

Companion files for the bioteam.net post "Letting ParallelCluster deploy itself
in a shared production AWS account". Read the post first; these are examples to
adapt, not a drop-in kit.

Where they come from
--------------------
Each file is a sanitised copy of a policy we deployed for a client running
AWS ParallelCluster 3.16.0 in a shared production account. Every account ID,
name, path, tag, subnet and region was replaced with a placeholder. Statement
IDs in the workload boundary were shortened to fit the size cap. The sanitised
versions were checked with IAM Access Analyzer validate-policy and with
"iam simulate-custom-policy" against allow and deny scenarios; they were not
re-deployed in their sanitised form.

Files
-----
workload-boundary.json            Permissions boundary for every role ParallelCluster
                                  creates (head node, compute, stack Lambdas). 6,100 of
                                  the 6,144 characters IAM allows (whitespace is not
                                  counted).
image-build-boundary.json         Permissions boundary for the build-image pipeline
                                  roles (Image Builder instance, cleanup Lambda).
pcluster-operator-services.json   The ParallelCluster-only part of the operator role:
                                  CloudFormation by stack name; Lambda, Image Builder,
                                  SNS, launch templates only through those stacks
                                  (aws:CalledVia); DynamoDB and CloudWatch by name.
deployer-iam.json                 The operator's only IAM write grant: roles under
                                  /lab/ only, and only with one of the two boundaries
                                  attached.

Placeholders to replace
-----------------------
111122223333                 your account ID
us-east-2                    your region
acme-hpc, acme-hpc-*         your cluster / stack names
acme-hpc-prod-               your resource-name prefix (buckets, RDS, backup vaults)
lab-runtime                  your SSM parameter / secret namespace
/lab/                        the IAM path ParallelCluster uses (Iam.ResourcePrefix)
/lab-guardrails/             the IAM path that holds the guardrail policies
lab:managed = true           your ownership tag
golden_image = true          tag on account-owned AMIs you trust as launch sources
subnet-0a1b2c3d4e5f6000[1-6] your HPC subnet IDs

What is NOT here
----------------
The rest of the operator roles (EC2 create-and-tag, the name-scoped data
services, read access, and the deny sets for shared networking, SSM,
security tooling and the Terraform state) were written against one client's
account layout. Generalising them is real work, so they are described in the
post rather than published.

No warranty. Test with "iam simulate-custom-policy" and live --dry-run calls
in your own account before you rely on any of it.
