feat: support GCR regions

installer/region_map.d/aws/000-cn-north-1.yaml

@@ -0,0 +1,26 @@
+---
+# SOCA AMI List for commercial partition generated 2025-08-01 20:57:46 UTC
+cn-north-1:
+  x86_64:
+    amazonlinux2: ami-044825ed7269ce5ae
+    amazonlinux2023: ami-07e6f3a55a0591957
+    rhel7: ami-03d8043294fea9aab
+    rhel8: ami-0a63ed58be40131a8
+    rhel9: ami-05c94ad454112ae74
+    rocky8: ami-0b45e59d7f20e48ab
+    rocky9: ami-07f5b7614f70a6c81
+    ubuntu2204: ami-0bb5b7a6a081b4071
+    ubuntu2404: ami-0a83c884ad208dfbc
+    windows2019: ami-0aced60d5a97d56c1
+    windows2022: ami-02862b4d551aae7ef
+    windows2025: ami-09b6bea2ea0353b56
+  arm64:
+    amazonlinux2: ami-0b6b5c2b39fbe6e25
+    amazonlinux2023: ami-0050bdea503afb267
+    rhel8: ami-057bc1aba4c81bbad
+    rhel9: ami-046deb8fe767796fa
+    # rocky8: not supported
+    rocky9: ami-05a30ad42a4562be2
+    ubuntu2204: ami-039b85aae4e82c275
+    ubuntu2404: ami-0a298ada2f151492b
+# SOCA AMI List for commercial partition generated 2025-08-01 20:57:46 UTC

installer/region_map.d/aws/000-cn-northwest-1.yaml

@@ -0,0 +1,26 @@
+---
+# SOCA AMI List for commercial partition generated 2025-08-01 20:57:46 UTC
+cn-northwest-1:
+  x86_64:
+    amazonlinux2: ami-074569be118d63cd3
+    amazonlinux2023: ami-0860d42a423b663c6
+    rhel7: ami-047eb9da7101b389f
+    rhel8: ami-099bfa7e6b651200b
+    rhel9: ami-0f03ab64a3798169d
+    rocky8: ami-03ef4ab38a835fa82
+    rocky9: ami-0d8859df92f1ff688
+    ubuntu2204: ami-0ee7890ada8cf3617
+    ubuntu2404: ami-01785c07ce58610d6
+    windows2019: ami-04de7b39d2aab1d8a
+    windows2022: ami-0774a48a7423faec4
+    windows2025: ami-0c1f49057ab497dd8
+  arm64:
+    amazonlinux2: ami-0c662664eb417cfe4
+    amazonlinux2023: ami-00c2a939d499dd3b9
+    rhel8: ami-0f5411e7d874d6a0e
+    rhel9: ami-084a9971dac348932
+    # rocky8: not supported
+    rocky9: ami-00c556f64bee59a22
+    ubuntu2204: ami-08e2c3633ffeab3e6
+    ubuntu2404: ami-04d9f0e389358b7b1
+# SOCA AMI List for commercial partition generated 2025-08-01 20:57:46 UTC

installer/resources/policies/ComputeNode.json

@@ -7,31 +7,11 @@
                 "s3:ListBucket"
             ],
             "Resource": [
-                "arn:%%AWS_PARTITION%%:s3:::dcv-license.%%AWS_REGION%%/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::nvidia-gaming/*",
-                "arn:%%AWS_PARTITION%%:s3:::nvidia-gaming-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers/*",
                 "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%/*",
-                "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%"
+                "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%"%%COMPUTE_NODE_MANAGED_BUCKETS%%
             ],
             "Effect": "Allow"
-        },
-        {
-            "Action": [
-                "ses:SendEmail"
-            ],
-            "Resource": [
-                "arn:%%AWS_PARTITION%%:ses:*:%%AWS_ACCOUNT_ID%%:identity*"
-            ],
-            "Effect": "Allow"
-        },
+        },%%SES_PERMISSIONS%%
         {
             "Action": [
                 "ec2:CreateTags"
@@ -69,21 +49,7 @@
                 "logs:PutLogEvents",
                 "logs:DescribeLogStreams"
             ],
-            "Resource": "arn:%%AWS_PARTITION%%:logs:%%AWS_REGION%%:*"
-        },
-        {
-            "Sid": "AllowSerialConsoleAccess",
-            "Action": [
-                "ec2-instance-connect:SendSerialConsoleSSHPublicKey",
-                "ec2-instance-connect:StartSerialConsoleSession"
-            ],
-            "Resource": "arn:%%AWS_PARTITION%%:ec2:*:%%AWS_ACCOUNT_ID%%:instance/*",
-            "Effect": "Allow",
-            "Condition": {
-                "StringEquals": {
-                    "ec2:ResourceTag/soca:ClusterId": "%%CLUSTER_ID%%"
-                }
-            }
-        }
+            "Resource": "*"
+        }%%EC2_INSTANCE_CONNECT_PERMISSIONS%%
     ]
-}
+}

installer/resources/policies/LoginNode.json

@@ -7,27 +7,11 @@
                 "s3:ListBucket"
             ],
             "Resource": [
-                "arn:%%AWS_PARTITION%%:s3:::dcv-license.%%AWS_REGION%%/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::nvidia-gaming/*",
-                "arn:%%AWS_PARTITION%%:s3:::nvidia-gaming-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers",
                 "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%/*",
-                "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%"
+                "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%"%%LOGIN_NODE_MANAGED_BUCKETS%%
             ],
             "Effect": "Allow"
-        },
-        {
-            "Action": [
-                "ses:SendEmail"
-            ],
-            "Resource": [
-                "arn:%%AWS_PARTITION%%:ses:*:%%AWS_ACCOUNT_ID%%:identity*"
-            ],
-            "Effect": "Allow"
-        },
+        },%%SES_PERMISSIONS%%
         {
             "Action": [
                 "ec2:CreateTags"
@@ -65,7 +49,7 @@
                 "logs:PutLogEvents",
                 "logs:DescribeLogStreams"
             ],
-            "Resource": "arn:%%AWS_PARTITION%%:logs:%%AWS_REGION%%:*"
+            "Resource": "*"
         }
     ]
-}
+}

installer/resources/policies/TargetNode.json

@@ -7,31 +7,11 @@
                 "s3:ListBucket"
             ],
             "Resource": [
-                "arn:%%AWS_PARTITION%%:s3:::dcv-license.%%AWS_REGION%%/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::nvidia-gaming/*",
-                "arn:%%AWS_PARTITION%%:s3:::nvidia-gaming-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers/*",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers",
-                "arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers/*",
                 "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%/*",
-                "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%"
+                "arn:%%AWS_PARTITION%%:s3:::%%BUCKET%%"%%TARGET_NODE_MANAGED_BUCKETS%%
             ],
             "Effect": "Allow"
-        },
-        {
-            "Action": [
-                "ses:SendEmail"
-            ],
-            "Resource": [
-                "arn:%%AWS_PARTITION%%:ses:*:%%AWS_ACCOUNT_ID%%:identity*"
-            ],
-            "Effect": "Allow"
-        },
+        },%%SES_PERMISSIONS%%
         {
             "Action": [
                 "ec2:CreateTags"
@@ -69,21 +49,7 @@
                 "logs:PutLogEvents",
                 "logs:DescribeLogStreams"
             ],
-            "Resource": "arn:%%AWS_PARTITION%%:logs:%%AWS_REGION%%:*"
-        },
-        {
-            "Sid": "AllowSerialConsoleAccess",
-            "Action": [
-                "ec2-instance-connect:SendSerialConsoleSSHPublicKey",
-                "ec2-instance-connect:StartSerialConsoleSession"
-            ],
-            "Resource": "arn:%%AWS_PARTITION%%:ec2:*:%%AWS_ACCOUNT_ID%%:instance/*",
-            "Effect": "Allow",
-            "Condition": {
-                "StringEquals": {
-                    "ec2:ResourceTag/soca:ClusterId": "%%CLUSTER_ID%%"
-                }
-            }
-        }
+            "Resource": "*"
+        }%%EC2_INSTANCE_CONNECT_PERMISSIONS%%
     ]
 }

installer/resources/src/cdk_construct.py

@@ -3049,8 +3049,76 @@ def iam_roles(self):
                 )
             )
 
-        # Generate IAM inline policies
+        # Handle IAM policies in standard regions and GCR regions
+        compute_node_managed_buckets = ""
+        target_node_managed_buckets = ""
+        login_node_managed_buckets = ""
+        ses_permissions = ""
+        ec2_instance_connect_permissions = ""
+
+        if self._region.startswith("cn-"):
+            # GCR regions don't have StartSerialConsoleSession
+            ec2_instance_connect_permissions = ',{' \
+            '"Sid": "AllowSerialConsoleAccess",' \
+            '"Action": ["ec2-instance-connect:SendSerialConsoleSSHPublicKey"],' \
+            '"Resource": "arn:%%AWS_PARTITION%%:ec2:*:%%AWS_ACCOUNT_ID%%:instance/*",' \
+            '"Effect": "Allow",' \
+            '"Condition": {"StringEquals": {"ec2:ResourceTag/soca:ClusterId": "%%CLUSTER_ID%%"}}}'
+        else:
+            ec2_instance_connect_permissions = ',{' \
+            '"Sid": "AllowSerialConsoleAccess",' \
+            '"Action": ' \
+            '["ec2-instance-connect:SendSerialConsoleSSHPublicKey","ec2-instance-connect:StartSerialConsoleSession"],' \
+            '"Resource": "arn:%%AWS_PARTITION%%:ec2:*:%%AWS_ACCOUNT_ID%%:instance/*",' \
+            '"Effect": "Allow",' \
+            '"Condition": {"StringEquals": {"ec2:ResourceTag/soca:ClusterId": "%%CLUSTER_ID%%"}}}'
+
+            compute_node_managed_buckets = ',' \
+            '"arn:%%AWS_PARTITION%%:s3:::dcv-license.%%AWS_REGION%%/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::nvidia-gaming/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::nvidia-gaming-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers/*"'
+
+            target_node_managed_buckets = ',' \
+            '"arn:%%AWS_PARTITION%%:s3:::dcv-license.%%AWS_REGION%%/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::nvidia-gaming/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::nvidia-gaming-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-windows-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-windows-nvidia-drivers/*"'
+
+            login_node_managed_buckets = ',' \
+            '"arn:%%AWS_PARTITION%%:s3:::dcv-license.%%AWS_REGION%%/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-linux-nvidia-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::nvidia-gaming/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::nvidia-gaming-drivers",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers/*",' \
+            '"arn:%%AWS_PARTITION%%:s3:::ec2-amd-linux-drivers"'
+
+            ses_permissions = '{' \
+            '"Action": ["ses:SendEmail"],' \
+            '"Resource": ["arn:%%AWS_PARTITION%%:ses:*:%%AWS_ACCOUNT_ID%%:identity*"],' \
+            '"Effect": "Allow"},'
+
         policy_substitutes = {
+            "%%COMPUTE_NODE_MANAGED_BUCKETS%%": compute_node_managed_buckets,
+            "%%TARGET_NODE_MANAGED_BUCKETS%%": target_node_managed_buckets,
+            "%%LOGIN_NODE_MANAGED_BUCKETS%%": login_node_managed_buckets,
+            "%%SES_PERMISSIONS%%": ses_permissions,
+            "%%EC2_INSTANCE_CONNECT_PERMISSIONS%%": ec2_instance_connect_permissions,
             "%%AWS_ACCOUNT_ID%%": Aws.ACCOUNT_ID,
             "%%AWS_PARTITION%%": Aws.PARTITION,
             "%%AWS_URL_SUFFIX%%": Aws.URL_SUFFIX,
@@ -3950,6 +4018,8 @@ def get_fsx_pricing_data(region: Optional[str]) -> list:
                 _pricing_region = "ap-south-1"
             elif region.startswith("eu"):
                 _pricing_region = "eu-central-1"
+            elif region.startswith("cn"):
+                _pricing_region = "cn-northwest-1"
             else:
                 # default to us-east-1
                 _pricing_region = "us-east-1"
@@ -7649,13 +7719,13 @@ def is_networking_af_enabled(self, address_family: str):
     }
 
     principals_suffix = {
-        "backup": f"backup.{Aws.URL_SUFFIX}",
-        "cloudwatch": f"cloudwatch.{Aws.URL_SUFFIX}",
-        "ec2": f"ec2.{Aws.URL_SUFFIX}",
-        "lambda": f"lambda.{Aws.URL_SUFFIX}",
-        "sns": f"sns.{Aws.URL_SUFFIX}",
-        "spotfleet": f"spotfleet.{Aws.URL_SUFFIX}",
-        "ssm": f"ssm.{Aws.URL_SUFFIX}",
+        "backup": "backup.amazonaws.com",
+        "cloudwatch": "cloudwatch.amazonaws.com",
+        "ec2": "ec2.amazonaws.com",
+        "lambda": "lambda.amazonaws.com",
+        "sns": "sns.amazonaws.com",
+        "spotfleet": "spotfleet.amazonaws.com",
+        "ssm": "ssm.amazonaws.com",
     }
 
     # Apply default tag to all taggable resources

installer/resources/src/install_soca.py

@@ -2363,12 +2363,21 @@ def override_keys(keys_to_override, install_properties):
         type=str,
         help="AWS region where you want to deploy your SOCA environment.",
     )
+    # Determine default config file based on AWS region
+    def get_default_config_path():
+        aws_region = os.environ.get('AWS_DEFAULT_REGION', '')
+        base_path = f"{os.path.dirname(os.path.realpath(__file__))}/../../"
+        if aws_region in ['cn-north-1', 'cn-northwest-1']:
+            return f"{base_path}default_config_cn.yml"
+        else:
+            return f"{base_path}default_config.yml"
+
     parser.add_argument(
         "--config",
         "-c",
         type=str,
-        default=f"{os.path.dirname(os.path.realpath(__file__))}/../../default_config.yml",
-        help="Path of custom config file(s). Defaults to default_config.yml .",
+        default=get_default_config_path(),
+        help="Path of custom config file(s). Defaults to default_config.yml or default_config_cn.yml based on AWS region.",
     )
     parser.add_argument(
         "--region-map",

installer/resources/user_data/controller/01_user_data.sh.j2

@@ -44,7 +44,7 @@ log_info "EC2 UserData script is being executed, check logs in /var/log/cloud-in
 {% if context.get("/configuration/Region") in ("us-gov-east-1', 'us-gov-west-1")  %}
   S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.{{ context.get("/configuration/Region") }}.amazonaws.com | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
 {% elif context.get("/configuration/Region") in ("cn-north-1", "cn-northwest-1")  %}
-  S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.amazonaws.com.cn | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
+  S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.{{ context.get("/configuration/Region") }}.amazonaws.com.cn | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
 {% else %}
   S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.amazonaws.com | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
 {% endif %}

installer/resources/user_data/controller/02_prerequisites.sh.j2

@@ -45,6 +45,8 @@ mkdir -p ${SOCA_HOME}
 # Retrieve the region of the bucket specified at install time
 {% if context.get("/configuration/Region") in ('us-gov-east-1', 'us-gov-west-1')  %}
   S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.{{ context.get("/configuration/Region") }}.amazonaws.com | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
+{% elif context.get("/configuration/Region") in ("cn-north-1", "cn-northwest-1") %}
+  S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.{{ context.get("/configuration/Region") }}.amazonaws.com.cn | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
 {% else %}
   S3_BUCKET_REGION=$(curl -s --head {{ context.get("/configuration/S3Bucket") }}.s3.amazonaws.com | grep bucket-region | awk '{print $2}' | tr -d '\r\n')
 {% endif %}

installer/resources/user_data/controller/03_setup.sh.j2

@@ -65,8 +65,22 @@ set_environment_variable "SOCA_CONTROLLER_IP" "$(hostname -I)"
 # Install NodeJS
 {% include "templates/linux/nodejs.sh.j2" %}
 
-# Install required Node modules
-${SOCA_BOOTSTRAP_ASSETS_FOLDER}/node/bin/npm install --prefix "/opt/soca/{{ context.get("/configuration/ClusterId") }}/cluster_manager/web_interface/static" [email protected]
+{% if context.get("/configuration/Region") in ("cn-north-1", "cn-northwest-1") %}
+  # Ensure Node.js environment is available and install required Node modules
+  if command -v npm >/dev/null 2>&1; then
+    npm install --prefix "/opt/soca/{{ context.get("/configuration/ClusterId") }}/cluster_manager/web_interface/static" [email protected]
+  else
+    # If npm is not in PATH, try to source NVM environment
+    if [ -f "${SOCA_BOOTSTRAP_ASSETS_FOLDER}/nvm/*/.*nvm/nvm.sh" ]; then
+      source "${SOCA_BOOTSTRAP_ASSETS_FOLDER}/nvm/*/.*nvm/nvm.sh"
+      npm install --prefix "/opt/soca/{{ context.get("/configuration/ClusterId") }}/cluster_manager/web_interface/static" [email protected]
+    else
+      log_warning "npm not available, skipping monaco-editor installation"
+    fi
+  fi
+{% else %}
+  ${SOCA_BOOTSTRAP_ASSETS_FOLDER}/node/bin/npm install --prefix "/opt/soca/{{ context.get("/configuration/ClusterId") }}/cluster_manager/web_interface/static" [email protected]
+{% endif %}
 
 # Reload OpenPBS
 systemctl restart pbs
@@ -146,6 +160,9 @@ IFS="-" read name sanitized_cluster_name <<< "echo {{ context.get("/configuratio
 sed -i "s/__SOCA_CLUSTER__NAME__/${sanitized_cluster_name}/g" /opt/soca/{{ context.get("/configuration/ClusterId") }}/cluster_manager/web_interface/templates/common/horizontal_menu_bar.html
 
 # Start Web UI
+{% if context.get("/configuration/Region") in ("cn-north-1", "cn-northwest-1") %}
+  chmod +x /opt/soca/{{ context.get("/configuration/ClusterId") }}/python/latest/bin/uwsgi
+{% endif %}
 chmod +x /opt/soca/{{ context.get("/configuration/ClusterId") }}/cluster_manager/web_interface/socawebui.sh
 ./socawebui.sh start