SuperCIDocumentation

What your AWS account allows

How SuperCI looks at an AWS account and works with what it allows: its regions, spot machines, CPUs at once and the runner image, and a project from AWS's new sign-up.

SuperCI works with what your AWS account allows, as it is. Nothing has to be changed in AWS to use it.

When you sign in, SuperCI looks at the account and shows what it found in the AWS account section of the Control plane, set-up and Add runners pages. In a terminal:

superci accounts retrieve aws

What it looks at

  • Regions. Which regions the account may work in. Where regions are chosen, one the account cannot use is shown and cannot be picked, with why.
  • Spot machines. Whether the account may start them. Where it may not, jobs run on on-demand machines, at about twice the price, and each job says so.
  • CPUs at once. How many jobs that is, with a link to ask AWS for more.
  • The runner image. Whether the image jobs run on is in each region the account may use.
  • Organization. Whether a rule comes from an AWS organization the account is in, and which policy it is.

It only reads and asks “could I”: nothing is started or changed by looking.

A project from AWS’s new sign-up

An account made with AWS’s new sign-up (the one that starts with a builder or Google sign-in) is a project. AWS keeps a project to one region, chosen by your address: Ohio, Stockholm or Sydney.

SuperCI sets up in that region and runs jobs there.

  • Spot machines are not allowed in a project until you activate advanced features in AWS’s Settings. Until then jobs run on on-demand machines. Activating cannot be undone and removes AWS’s spend limit, so set limits of your own first.
  • The runner image is not published in every region. Where it is missing, the set-up page offers to copy it into your account first: about ten minutes, and about $1.50 a month for its storage. In a terminal: superci images create REGION.

A copied image starts slower at first (about 25 seconds from queued to running, against about 16 with the published one) and gets faster as it is used.

Allowing more regions

You do not need to. It helps only if you want jobs in a region the account cannot use today, such as N. Virginia, where the published image starts fastest.

The rule that refuses a region belongs to the AWS organization the account is in. Only that organization’s management account can change it. SuperCI never signs in to a management account and changes no rule: you change it yourself, in AWS’s console.

  1. Sign in to AWS’s console with the organization’s management account. For a project, you have one only after activating advanced features: AWS’s Settings lists it under Management accounts.
  2. Open AWS Organizations, then Policies, then Service control policies.
  3. Open the region policy. The list shows names: for a project it is AdvancedModeRegionRestrictionSecurityControlPolicy. Its page shows its id, the one SuperCI names in the Regions row (it looks like p-a1b2c3d4).
  4. Press Edit policy and change only what the region you want needs:
To allowChange
N. Virginia (us-east-1)Delete the whole statement whose Sid is UsEast1Partitional.
Oregon (us-west-2)Delete the whole statement whose Sid is UsWest2Partitional.
Any other regionIn the statement RegionFloor, add the region to the list under aws:RequestedRegion, for example "eu-west-1".

Those two statements are why N. Virginia and Oregon look half open in a project: AWS allows its global services there and refuses the rest. The last statement refuses every region that is not on its list.

SuperCI shows the change within ten minutes; superci accounts retrieve aws shows it at once.

If your company runs the organization, ask whoever manages it.