Create a Spot Fleet - Amazon Elastic Compute Cloud

Create a Spot Fleet

Using the AWS Management Console, quickly create a Spot Fleet request by choosing only an AMI and your desired total target capacity. Amazon EC2 will configure a fleet that best meets your needs and follows Spot best practice. For more information, see Quickly create a Spot Fleet request (console). Otherwise, you can modify any of the default settings. For more information, see Create a Spot Fleet request using defined parameters (console) and Create a Spot Fleet using the AWS CLI.

If you want to include On-Demand Instances in your fleet, you need to specify a launch template in your request and specify you desired On-Demand capacity.

The fleet launches On-Demand Instances when capacity is available, and launches Spot Instances when your maximum price exceeds the Spot price and capacity is available.

If your fleet includes Spot Instances and is of type maintain, Amazon EC2 will attempt to maintain your fleet target capacity when your Spot Instances are interrupted.

Spot Fleet permissions

If your users will create or manage a Spot Fleet, you need to grant them the required permissions.

If you use the Amazon EC2 console to create a Spot Fleet, it creates two service-linked roles named AWSServiceRoleForEC2SpotFleet and AWSServiceRoleForEC2Spot, and a role named aws-ec2-spot-fleet-tagging-role that grant the Spot Fleet the permissions to request, launch, terminate, and tag resources on your behalf. If you use the AWS CLI or an API, you must ensure that these roles exist.

Use the following instructions to grant the required permissions and create the roles.

Grant permission to users for Spot Fleet

If your users will create or manage a Spot Fleet, be sure to grant them the required permissions.

To create a policy for Spot Fleet
  1. Open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Policies, Create policy.

  3. On the Create policy page, choose JSON, and replace the text with the following.

    { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateTags", "ec2:RequestSpotFleet", "ec2:ModifySpotFleetRequest", "ec2:CancelSpotFleetRequests", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequestHistory" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole", "iam:ListRoles", "iam:ListInstanceProfiles" ], "Resource": "*" } ] }

    The preceding example policy grants a user the permissions required for most Spot Fleet use cases. To limit the user to specific API actions, specify only those API actions instead.

    Required EC2 and IAM APIs

    The following APIs must be included in the policy:

    • ec2:RunInstances – Required to launch instances in a Spot Fleet

    • ec2:CreateTags – Required to tag the Spot Fleet request, instances, or volumes

    • iam:PassRole – Required to specify the Spot Fleet role

    • iam:CreateServiceLinkedRole – Required to create the service-linked role

    • iam:ListRoles – Required to enumerate existing IAM roles

    • iam:ListInstanceProfiles – Required to enumerate existing instance profiles

    Important

    If you specify a role for the IAM instance profile in the launch specification or launch template, you must grant the user the permission to pass the role to the service. To do this, in the IAM policy include "arn:aws:iam::*:role/IamInstanceProfile-role" as a resource for the iam:PassRole action. For more information, see Granting a user permissions to pass a role to an AWS service in the IAM User Guide.

    Spot Fleet APIs

    Add the following Spot Fleet API actions to your policy, as needed:

    • ec2:RequestSpotFleet

    • ec2:ModifySpotFleetRequest

    • ec2:CancelSpotFleetRequests

    • ec2:DescribeSpotFleetRequests

    • ec2:DescribeSpotFleetInstances

    • ec2:DescribeSpotFleetRequestHistory

    Optional IAM APIs

    (Optional) To enable a user to create roles or instance profiles using the IAM console, you must add the following actions to the policy:

    • iam:AddRoleToInstanceProfile

    • iam:AttachRolePolicy

    • iam:CreateInstanceProfile

    • iam:CreateRole

    • iam:GetRole

    • iam:ListPolicies

  4. Choose Review policy.

  5. On the Review policy page, enter a policy name and description, and choose Create policy.

  6. To provide access, add permissions to your users, groups, or roles:

Service-linked role for Spot Fleet

Amazon EC2 uses service-linked roles for the permissions that it requires to call other AWS services on your behalf. A service-linked role is a unique type of IAM role that is linked directly to an AWS service. Service-linked roles provide a secure way to delegate permissions to AWS services because only the linked service can assume a service-linked role. For more information, see Service-linked roles in the IAM User Guide.

Amazon EC2 uses the service-linked role named AWSServiceRoleForEC2SpotFleet to launch and manage instances on your behalf.

Important

If you specify an encrypted AMI or an encrypted Amazon EBS snapshot in your Spot Fleet, you must grant the AWSServiceRoleForEC2SpotFleet role permission to use the CMK so that Amazon EC2 can launch instances on your behalf. For more information, see Grant access to CMKs for use with encrypted AMIs and EBS snapshots.

Permissions granted by AWSServiceRoleForEC2SpotFleet

The AWSServiceRoleForEC2SpotFleet role grants the Spot Fleet permission to request, launch, terminate, and tag instances on your behalf. Amazon EC2 uses this service-linked role to complete the following actions:

  • ec2:RequestSpotInstances - Request Spot Instances

  • ec2:RunInstances - Launch instances

  • ec2:TerminateInstances - Terminate instances

  • ec2:DescribeImages - Describe Amazon Machine Images (AMIs) for the instances

  • ec2:DescribeInstanceStatus - Describe the status of the instances

  • ec2:DescribeSubnets - Describe the subnets for the instances

  • ec2:CreateTags - Add tags to the Spot Fleet request, instances, and volumes

  • elasticloadbalancing:RegisterInstancesWithLoadBalancer - Add the specified instances to the specified load balancer

  • elasticloadbalancing:RegisterTargets - Register the specified targets with the specified target group

Create the service-linked role

Under most circumstances, you don't need to manually create a service-linked role. Amazon EC2 creates the AWSServiceRoleForEC2SpotFleet service-linked role the first time you create a Spot Fleet using the console.

If you had an active Spot Fleet request before October 2017, when Amazon EC2 began supporting this service-linked role, Amazon EC2 created the AWSServiceRoleForEC2SpotFleet role in your AWS account. For more information, see A new role appeared in my AWS account in the IAM User Guide.

If you use the AWS CLI or an API to create a Spot Fleet, you must first ensure that this role exists.

To create the AWSServiceRoleForEC2SpotFleet role for Spot Fleet using the console
  1. Open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Roles.

  3. Choose Create role.

  4. On the Select trusted entity page, do the following:

    1. For Trusted entity type, choose AWS service.

    2. Under Use case, for Service or use case, choose EC2.

    3. For Use case, choose EC2 - Spot Fleet.

      Note

      The EC2 - Spot Fleet use case will automatically create a policy with the required IAM permissions and will suggest AWSEC2SpotFleetServiceRolePolicy as the role name.

    4. Choose Next.

  5. On the Add permissions page, choose Next.

  6. On the Name, review, and create page, choose Create role.

To create the AWSServiceRoleForEC2SpotFleet role for Spot Fleet using the AWS CLI

Use the create-service-linked-role command as follows.

aws iam create-service-linked-role --aws-service-name spotfleet.amazonaws.com

If you no longer need to use Spot Fleet, we recommend that you delete the AWSServiceRoleForEC2SpotFleet role. After this role is deleted from your account, Amazon EC2 will create the role again if you request a Spot Fleet using the console. For more information, see Deleting a service-linked role in the IAM User Guide.

Grant access to CMKs for use with encrypted AMIs and EBS snapshots

If you specify an encrypted AMI or an encrypted Amazon EBS snapshot in your Spot Fleet request and you use a customer managed key for encryption, you must grant the AWSServiceRoleForEC2SpotFleet role permission to use the CMK so that Amazon EC2 can launch instances on your behalf. To do this, you must add a grant to the CMK, as shown in the following procedure.

When providing permissions, grants are an alternative to key policies. For more information, see Using Grants and Using Key Policies in AWS KMS in the AWS Key Management Service Developer Guide.

To grant the AWSServiceRoleForEC2SpotFleet role permissions to use the CMK
  • Use the create-grant command to add a grant to the CMK and to specify the principal (the AWSServiceRoleForEC2SpotFleet service-linked role) that is given permission to perform the operations that the grant permits. The CMK is specified by the key-id parameter and the ARN of the CMK. The principal is specified by the grantee-principal parameter and the ARN of the AWSServiceRoleForEC2SpotFleet service-linked role.

    aws kms create-grant \ --region us-east-1 \ --key-id arn:aws:kms:us-east-1:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab \ --grantee-principal arn:aws:iam::111122223333:role/AWSServiceRoleForEC2SpotFleet \ --operations "Decrypt" "Encrypt" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "CreateGrant" "DescribeKey" "ReEncryptFrom" "ReEncryptTo"

Service-linked role for Spot Instances

Amazon EC2 uses the service-linked role named AWSServiceRoleForEC2Spot to launch and manage Spot Instances on your behalf. For more information, see Service-linked role for Spot Instance requests.

IAM role for tagging a Spot Fleet

The aws-ec2-spot-fleet-tagging-role IAM role grants the Spot Fleet permission to tag the Spot Fleet request, instances, and volumes. For more information, see Tag a new or existing Spot Fleet request and the instances and volumes it launches.

Important

If you choose to tag instances in the fleet and you also choose to maintain target capacity (the Spot Fleet request is of type maintain), the differences in the permissions that are set for the user and the IamFleetRole might lead to inconsistent tagging behavior of instances in the fleet. If the IamFleetRole does not include the CreateTags permission, some of the instances launched by the fleet might not be tagged. While we are working to fix this inconsistency, to ensure that all instances launched by the fleet are tagged, we recommend that you use the aws-ec2-spot-fleet-tagging-role role for the IamFleetRole. Alternatively, to use an existing role, attach the AmazonEC2SpotFleetTaggingRole AWS Managed Policy to the existing role. Otherwise, you need to manually add the CreateTags permission to your existing policy.

To create the IAM role for tagging a Spot Fleet
  1. Open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Roles.

  3. Choose Create role.

  4. On the Select trusted entity page, under Trusted entity type, choose AWS service.

  5. Under Use case, from Use cases for other AWS services, choose EC2, and then choose EC2 - Spot Fleet Tagging.

  6. Choose Next.

  7. On the Add permissions page, choose Next.

  8. On the Name, review, and create page, for Role name, enter a name for the role (for example, aws-ec2-spot-fleet-tagging-role).

  9. Review the information on the page, and then choose Create role.

Cross-service confused deputy prevention

The confused deputy problem is a security issue where an entity that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action. We recommend that you use the aws:SourceArn and aws:SourceAccount global condition context keys in the aws-ec2-spot-fleet-tagging-role trust policy to limit the permissions that Spot Fleet gives another service to the resource.

To add the aws:SourceArn and aws:SourceAccount condition keys to the aws-ec2-spot-fleet-tagging-role trust policy
  1. Open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Roles.

  3. Find the aws-ec2-spot-fleet-tagging-role that you created previously and choose the link (not the check box).

  4. Under Summary, choose the Trust relationships tab, and then choose Edit trust policy.

  5. In the JSON statement, add a Condition element containing your aws:SourceAccount and aws:SourceArn global condition context keys to prevent the confused deputy problem, as follows:

    "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:ec2:us-east-1:account_id:spot-fleet-request/sfr-*" }, "StringEquals": { "aws:SourceAccount": "account_id" }
    Note

    If the aws:SourceArn value contains the account ID and you use both global condition context keys, the aws:SourceAccount value and the account in the aws:SourceArn value must use the same account ID when used in the same policy statement.

    The final trust policy will be as follows:

    { "Version": "2012-10-17", "Statement": { "Sid": "ConfusedDeputyPreventionExamplePolicy", "Effect": "Allow", "Principal": { "Service": "spotfleet.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:ec2:us-east-1:account_id:spot-fleet-request/sfr-*" }, "StringEquals": { "aws:SourceAccount": "account_id" } } } }
  6. Choose Update policy.

The following table provides potential values for aws:SourceArn to limit the scope of the your aws-ec2-spot-fleet-tagging-role in varying degrees of specificity.

API operation Called service Scope aws:SourceArn
RequestSpotFleet AWS STS (AssumeRole) Limit the AssumeRole capability on aws-ec2-spot-fleet-tagging-role to spot-fleet-requests in the specified account. arn:aws:ec2:*:123456789012:spot-fleet-request/sfr-*
RequestSpotFleet AWS STS (AssumeRole) Limit the AssumeRole capability on aws-ec2-spot-fleet-tagging-role to spot-fleet-requests in the specified account and specified Region. Note that this role will not be usable in other Regions. arn:aws:ec2:us-east-1:123456789012:spot-fleet-request/sfr-*
RequestSpotFleet AWS STS (AssumeRole) Limit the AssumeRole capability on aws-ec2-spot-fleet-tagging-role to only actions affecting the fleet sfr-11111111-1111-1111-1111-111111111111. Note that this role may not be usable for other Spot Fleets. Also, this role cannot be used to launch any new Spot Fleets through request-spot-fleet. arn:aws:ec2:us-east-1:123456789012:spot-fleet-request/sfr-11111111-1111-1111-1111-111111111111

Quickly create a Spot Fleet request (console)

Follow these steps to quickly create a Spot Fleet request.

To create a Spot Fleet request using the recommended settings (console)
  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Spot Requests.

  3. If you are new to Spot, you see a welcome page; choose Get started. Otherwise, choose Request Spot Instances.

  4. Under Launch parameters, choose Manually configure launch parameters.

  5. For AMI, choose an AMI.

  6. Under Target capacity, for Total target capacity, specify the number of units to request. For the type of unit, you can choose Instances, vCPUs, or Memory (GiB).

  7. For Your fleet request at a glance, review your fleet configuration, and choose Launch.

Create a Spot Fleet request using defined parameters (console)

You can create a Spot Fleet by using parameters that you define.

To create a Spot Fleet request using defined parameters (console)
  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Spot Requests.

  3. If you are new to Spot, you see a welcome page; choose Get started. Otherwise, choose Request Spot Instances.

  4. For Launch parameters, you can either manually configure the launch parameters or you can use a launch template, as follows:

    1. [Manually configure] To define the launch parameters in the Amazon EC2 console, choose Manually configure launch parameters, and then do the following:

      1. For AMI, choose one of the basic AMIs provided by AWS, or choose Search for AMI to use an AMI from our user community, the AWS Marketplace, or one of your own.

        Note

        If an AMI specified in the launch parameters is deregistered or disabled, no new instances can be launched from the AMI. For fleets that are set to maintain target capacity, the target capacity will not be maintained.

      2. (Optional) For Key pair name, choose an existing key pair or create a new one.

        [Existing key pair] Choose the key pair.

        [New key pair] Choose Create new key pair to go the Key pairs page. When you are done, return to the Spot Requests page and refresh the list.

      3. (Optional) Expand Additional launch parameters, and do the following:

        1. (Optional) To enable Amazon EBS optimization, for EBS-optimized, select Launch EBS-optimized instances.

        2. (Optional) To add temporary block-level storage for your instances, for Instance store, choose Attach at launch.

        3. (Optional) To add storage, choose Add new volume, and specify additional instance store volumes or Amazon EBS volumes, depending on the instance type.

        4. (Optional) By default, basic monitoring is enabled for your instances. To enable detailed monitoring, for Monitoring, select Enable CloudWatch detailed monitoring.

        5. (Optional) To run a Dedicated Spot Instance, for Tenancy, choose Dedicated - run a dedicated instance.

        6. (Optional) For Security groups, choose one or more security groups or create a new one.

          [Existing security group] Choose one or more security groups.

          [New security group] Choose Create new security group to go the Security Groups page. When you are done, return to the Spot Requests and refresh the list.

        7. (Optional) To make your instances reachable from the internet, for Auto-assign IPv4 Public IP, choose Enable.

        8. (Optional) To launch your Spot Instances with an IAM role, for IAM instance profile, choose the role.

        9. (Optional) To run a start-up script, copy it to User data.

        10. (Optional) To add a tag, choose Create tag and enter the key and value for the tag, and choose Create. Repeat for each tag.

          For each tag, to tag the instances and the Spot Fleet request with the same tag, ensure that both Instances and Fleet are selected. To tag only the instances launched by the fleet, clear Fleet. To tag only the Spot Fleet request, clear Instances.

    2. [Launch template] To use a configuration you created in a launch template, choose Use a launch template, and for Launch template, choose a launch template.

      Note

      If you want On-Demand capacity in your Spot Fleet, you must specify a launch template.

  5. For Additional request details, do the following:

    1. Review the additional request details. To make changes, clear Apply defaults.

    2. (Optional) For IAM fleet role, you can use the default role or choose a different role. To use the default role after changing the role, choose Use default role.

    3. (Optional) To create a request that is valid only during a specific time period, edit Request valid from and Request valid until.

    4. (Optional) By default, Amazon EC2 terminates your Spot Instances when the Spot Fleet request expires. To keep them running after your request expires, clear Terminate the instances when the request expires.

    5. (Optional) To register your Spot Instances with a load balancer, choose Receive traffic from one or more load balancers and choose one or more Classic Load Balancers or target groups.

  6. For Target capacity, do the following:

    1. For Total target capacity, specify the number of units to request. For the type of unit, you can choose Instances, vCPUs, or Memory (MiB). To specify a target capacity of 0 so that you can add capacity later, you must first select Maintain target capacity.

    2. (Optional) For Include On-Demand base capacity, specify the number of On-Demand units to request. The number must be less than the Total target capacity. Amazon EC2 calculates the difference, and allocates the difference to Spot units to request.

      Important

      To specify optional On-Demand capacity, you must first choose a launch template.

    3. (Optional) By default, Amazon EC2 terminates Spot Instances when they are interrupted. To maintain the target capacity, select Maintain target capacity. You can then specify that Amazon EC2 terminates, stops, or hibernates Spot Instances when they are interrupted. To do so, choose the corresponding option from Interruption behavior.

      Note

      If an AMI specified in the launch parameters is deregistered or disabled, no new instances can be launched from the AMI. In this case, for fleets that are set to maintain target capacity, the target capacity will not be maintained.

    4. (Optional) To allow Spot Fleet to launch a replacement Spot Instance when an instance rebalance notification is emitted for an existing Spot Instance in the fleet, select Capacity rebalance, and then choose an instance replacement strategy. If you choose Launch before terminate, specify the delay (in seconds) before Amazon EC2 terminates the old instances. For more information, see Use Capacity Rebalancing in EC2 Fleet and Spot Fleet to replace at-risk Spot Instances.

    5. (Optional) To control the amount you pay per hour for all the Spot Instances in your fleet, select Set maximum cost for Spot Instances and then enter the maximum total amount you're willing to pay per hour. When the maximum total amount is reached, Spot Fleet stops launching Spot Instances even if it hasn’t met the target capacity. For more information, see Set a spending limit for your EC2 Fleet or Spot Fleet.

  7. For Network, do the following:

    1. For Network, choose an existing VPC or create a new one.

      [Existing VPC] Choose the VPC.

      [New VPC] Choose Create new VPC to go the Amazon VPC console. When you're done, return to this screen and refresh the list.

    2. (Optional) For Availability Zone, let Amazon EC2 choose the Availability Zones for your Spot Instances, or specify one or more Availability Zones.

      If you have more than one subnet in an Availability Zone, choose the appropriate subnet from Subnet. To add subnets, choose Create new subnet to go to the Amazon VPC console. When you are done, return to this screen and refresh the list.

  8. For Instance type requirements, you can either specify instance attributes and let Amazon EC2 identify the optimal instance types with these attributes, or you can specify a list of instances. For more information, see Specify attributes for instance type selection for EC2 Fleet or Spot Fleet.

    1. If you choose Specify instance attributes that match your compute requirements, specify your instance attributes as follows:

      1. For vCPUs, enter the desired minimum and maximum number of vCPUs. To specify no limit, select No minimum or No maximum, or both.

      2. For Memory (GiB), enter the desired minimum and maximum amount of memory. To specify no limit, select No minimum or No maximum, or both.

      3. (Optional) For Additional instance attribute, you can optionally specify one or more attributes to express your compute requirements in more detail. Each additional attribute adds a further constraint to your request. You can omit the additional attributes; when omitted, the default values are used. For a description of each attribute and their default values, see get-spot-placement-scores in the Amazon EC2 Command Line Reference.

      4. (Optional) To view the instance types with your specified attributes, expand Preview matching instance types. To exclude instance types from being used in your request, select the instances and then choose Exclude selected instance types.

    2. If you choose Manually select instance types, Spot Fleet provides a default list of instance types. To select more instance types, choose Add instance types, select the instance types to use in your request, and choose Select. To delete instance types, select the instance types and choose Delete.

  9. For Allocation strategy, choose a Spot allocation strategy and an On-Demand allocation strategy that meets your needs. For more information, see Use allocation strategies to determine how EC2 Fleet or Spot Fleet fulfills Spot and On-Demand capacity.

  10. For Your fleet request at a glance, review your fleet configuration, and make any adjustments if necessary.

  11. (Optional) To download a copy of the launch configuration for use with the AWS CLI, choose JSON config.

  12. When you're ready to launch your Spot Fleet, choose Launch.

    The Spot Fleet request type is fleet. When the request is fulfilled, requests of type instance are added, where the state is active and the status is fulfilled.

Create a Spot Fleet using the AWS CLI

To create a Spot Fleet request using the AWS CLI

Use the request-spot-fleet command to create a Spot Fleet request.

aws ec2 request-spot-fleet --spot-fleet-request-config file://config.json

For example configuration files, see Example CLI configurations Spot Fleet.

The following is example output:

{ "SpotFleetRequestId": "sfr-73fbd2ce-aa30-494c-8788-1cee4EXAMPLE" }

Create a Spot Fleet that replaces unhealthy Spot Instances

Spot Fleet checks the health status of the Spot Instances in the fleet every two minutes. The health status of an instance is either healthy or unhealthy.

Spot Fleet determines the health status of an instance by using the status checks provided by Amazon EC2. An instance is determined as unhealthy when the status of either the instance status check or the system status check is impaired for three consecutive health checks. For more information, see Status checks for Amazon EC2 instances.

You can configure your fleet to replace unhealthy Spot Instances. After enabling health check replacement, a Spot Instance is replaced when it is reported as unhealthy. The fleet could go below its target capacity for up to a few minutes while an unhealthy Spot Instance is being replaced.

Requirements
  • Health check replacement is supported only for Spot Fleets that maintain a target capacity (fleets of type maintain), not for one-time Spot Fleets (fleets of type request).

  • Health check replacement is supported only for Spot Instances. This feature is not supported for On-Demand Instances.

  • You can configure your Spot Fleet to replace unhealthy instances only when you create it.

  • Users can use health check replacement only if they have permission to call the ec2:DescribeInstanceStatus action.

Console
To configure a Spot Fleet to replace unhealthy Spot Instances using the console
  1. Follow the steps for creating a Spot Fleet in Create a Spot Fleet request using defined parameters (console).

  2. To configure the fleet to replace unhealthy Spot Instances, expand Additional launch parameters, and under Health check, select Replace unhealthy instances. To enable this option, you must first choose Maintain target capacity.

AWS CLI
To configure a Spot Fleet to replace unhealthy Spot Instances using the AWS CLI
  1. Follow the steps for creating a Spot Fleet in Create a Spot Fleet using the AWS CLI.

  2. To configure the fleet to replace unhealthy Spot Instances, for ReplaceUnhealthyInstances, enter true.