anyscale 0.5.165__tar.gz → 0.5.166__tar.gz

{anyscale-0.5.165 → anyscale-0.5.166}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: anyscale
-Version: 0.5.165
+Version: 0.5.166
 Summary: Command Line Interface for Anyscale
 Author: Anyscale Inc.
 License: AS License

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/client/README.md

@@ -667,6 +667,7 @@ Class | Method | HTTP request | Description
  - [MinicomputetemplateListResponse](docs/MinicomputetemplateListResponse.md)
  - [MiniprojectListResponse](docs/MiniprojectListResponse.md)
  - [MonitorLogsExtension](docs/MonitorLogsExtension.md)
+ - [NamedEntity](docs/NamedEntity.md)
  - [NetworkInterface](docs/NetworkInterface.md)
  - [NodeRegistrationAWS](docs/NodeRegistrationAWS.md)
  - [NodeRegistrationGCP](docs/NodeRegistrationGCP.md)

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/client/openapi_client/__init__.py

@@ -339,6 +339,7 @@ from openapi_client.models.minibuild_list_response import MinibuildListResponse
 from openapi_client.models.minicomputetemplate_list_response import MinicomputetemplateListResponse
 from openapi_client.models.miniproject_list_response import MiniprojectListResponse
 from openapi_client.models.monitor_logs_extension import MonitorLogsExtension
+from openapi_client.models.named_entity import NamedEntity
 from openapi_client.models.network_interface import NetworkInterface
 from openapi_client.models.node_registration_aws import NodeRegistrationAWS
 from openapi_client.models.node_registration_gcp import NodeRegistrationGCP

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/client/openapi_client/api/default_api.py

@@ -13514,7 +13514,7 @@ class DefaultApi(object):
     def get_log_files_api_v2_logs_get_log_files_post(self, **kwargs):  # noqa: E501
         """Get Log Files  # noqa: E501
 
-        API for downloading logs of a session.   This is a paginated api, which means that a single call to this will result in one page of results (log files).  The page size and next page token (in LogDownloadRequest) can be used to list all log files, either iteratively or in a single go.   Parameters  ---------- log_download_request: LogDownloadRequest      Parameters to filter logs and control download. This is read from the request body.   Returns  -------  Response[LogDownloadResult]      List of logs files, with their presigned URL and next page token if there are more results.   Raises  ------  HTTPException(400)      If the user is using a cloud provider (currently non-AWS) that does not support this feature.   HTTPException(401)      If the user does not have access to the session.   HTTPException(404)      If the session or cloud could not be found in the DB.   HTTPException(500)      If there are any other errors while downloading logs.    # noqa: E501
+        API for downloading logs of a session.   This is a paginated api, which means that a single call to this will result in one page of results (log files).  The page size and next page token (in LogDownloadRequest) can be used to list all log files, either iteratively or in a single go.   Parameters  ---------- log_download_request: LogDownloadRequest      Parameters to filter logs and control download. This is read from the request body.   Returns  -------  Response[LogDownloadResult]      List of logs files, with their presigned URL and next page token if there are more results.   Raises  ------  HTTPException(400)      If the user is using a cloud provider (currently non-AWS) that does not support this feature.   HTTPException(403)      If the user does not have access to the session.   HTTPException(404)      If the session or cloud could not be found in the DB.   HTTPException(500)      If there are any other errors while downloading logs.    # noqa: E501
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
         >>> thread = api.get_log_files_api_v2_logs_get_log_files_post(async_req=True)
@@ -13539,7 +13539,7 @@ class DefaultApi(object):
     def get_log_files_api_v2_logs_get_log_files_post_with_http_info(self, **kwargs):  # noqa: E501
         """Get Log Files  # noqa: E501
 
-        API for downloading logs of a session.   This is a paginated api, which means that a single call to this will result in one page of results (log files).  The page size and next page token (in LogDownloadRequest) can be used to list all log files, either iteratively or in a single go.   Parameters  ---------- log_download_request: LogDownloadRequest      Parameters to filter logs and control download. This is read from the request body.   Returns  -------  Response[LogDownloadResult]      List of logs files, with their presigned URL and next page token if there are more results.   Raises  ------  HTTPException(400)      If the user is using a cloud provider (currently non-AWS) that does not support this feature.   HTTPException(401)      If the user does not have access to the session.   HTTPException(404)      If the session or cloud could not be found in the DB.   HTTPException(500)      If there are any other errors while downloading logs.    # noqa: E501
+        API for downloading logs of a session.   This is a paginated api, which means that a single call to this will result in one page of results (log files).  The page size and next page token (in LogDownloadRequest) can be used to list all log files, either iteratively or in a single go.   Parameters  ---------- log_download_request: LogDownloadRequest      Parameters to filter logs and control download. This is read from the request body.   Returns  -------  Response[LogDownloadResult]      List of logs files, with their presigned URL and next page token if there are more results.   Raises  ------  HTTPException(400)      If the user is using a cloud provider (currently non-AWS) that does not support this feature.   HTTPException(403)      If the user does not have access to the session.   HTTPException(404)      If the session or cloud could not be found in the DB.   HTTPException(500)      If there are any other errors while downloading logs.    # noqa: E501
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
         >>> thread = api.get_log_files_api_v2_logs_get_log_files_post_with_http_info(async_req=True)

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/client/openapi_client/models/__init__.py

@@ -325,6 +325,7 @@ from openapi_client.models.minibuild_list_response import MinibuildListResponse
 from openapi_client.models.minicomputetemplate_list_response import MinicomputetemplateListResponse
 from openapi_client.models.miniproject_list_response import MiniprojectListResponse
 from openapi_client.models.monitor_logs_extension import MonitorLogsExtension
+from openapi_client.models.named_entity import NamedEntity
 from openapi_client.models.network_interface import NetworkInterface
 from openapi_client.models.node_registration_aws import NodeRegistrationAWS
 from openapi_client.models.node_registration_gcp import NodeRegistrationGCP

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/client/openapi_client/models/aica_model.py

@@ -43,7 +43,7 @@ class AicaModel(object):
         'is_model_stored_in_anyscale_account': 'bool',
         'generation_configuration_json': 'object',
         'created_at': 'datetime',
-        'cloud_id': 'str'
+        'cloud': 'NamedEntity'
     }
 
     attribute_map = {
@@ -57,10 +57,10 @@ class AicaModel(object):
         'is_model_stored_in_anyscale_account': 'is_model_stored_in_anyscale_account',
         'generation_configuration_json': 'generation_configuration_json',
         'created_at': 'created_at',
-        'cloud_id': 'cloud_id'
+        'cloud': 'cloud'
     }
 
-    def __init__(self, id=None, emoji=None, description=None, base_canonical_model_id=None, min_aviary_version=None, max_aviary_version=None, model_object_storage_uri=None, is_model_stored_in_anyscale_account=None, generation_configuration_json=None, created_at=None, cloud_id=None, local_vars_configuration=None):  # noqa: E501
+    def __init__(self, id=None, emoji=None, description=None, base_canonical_model_id=None, min_aviary_version=None, max_aviary_version=None, model_object_storage_uri=None, is_model_stored_in_anyscale_account=None, generation_configuration_json=None, created_at=None, cloud=None, local_vars_configuration=None):  # noqa: E501
         """AicaModel - a model defined in OpenAPI"""  # noqa: E501
         if local_vars_configuration is None:
             local_vars_configuration = Configuration()
@@ -76,7 +76,7 @@ class AicaModel(object):
         self._is_model_stored_in_anyscale_account = None
         self._generation_configuration_json = None
         self._created_at = None
-        self._cloud_id = None
+        self._cloud = None
         self.discriminator = None
 
         self.id = id
@@ -97,8 +97,8 @@ class AicaModel(object):
         if generation_configuration_json is not None:
             self.generation_configuration_json = generation_configuration_json
         self.created_at = created_at
-        if cloud_id is not None:
-            self.cloud_id = cloud_id
+        if cloud is not None:
+            self.cloud = cloud
 
     @property
     def id(self):
@@ -331,27 +331,25 @@ class AicaModel(object):
         self._created_at = created_at
 
     @property
-    def cloud_id(self):
-        """Gets the cloud_id of this AicaModel.  # noqa: E501
+    def cloud(self):
+        """Gets the cloud of this AicaModel.  # noqa: E501
 
-        The cloud id for the model. If None, this model is a base model.  # noqa: E501
 
-        :return: The cloud_id of this AicaModel.  # noqa: E501
-        :rtype: str
+        :return: The cloud of this AicaModel.  # noqa: E501
+        :rtype: NamedEntity
         """
-        return self._cloud_id
+        return self._cloud
 
-    @cloud_id.setter
-    def cloud_id(self, cloud_id):
-        """Sets the cloud_id of this AicaModel.
+    @cloud.setter
+    def cloud(self, cloud):
+        """Sets the cloud of this AicaModel.
 
-        The cloud id for the model. If None, this model is a base model.  # noqa: E501
 
-        :param cloud_id: The cloud_id of this AicaModel.  # noqa: E501
-        :type: str
+        :param cloud: The cloud of this AicaModel.  # noqa: E501
+        :type: NamedEntity
         """
 
-        self._cloud_id = cloud_id
+        self._cloud = cloud
 
     def to_dict(self):
         """Returns the model properties as a dict"""

anyscale-0.5.166/anyscale/client/openapi_client/models/named_entity.py

@@ -0,0 +1,148 @@
+# coding: utf-8
+
+"""
+    Managed Ray API
+
+    No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)  # noqa: E501
+
+    The version of the OpenAPI document: 0.1.0
+    Generated by: https://openapi-generator.tech
+"""
+
+
+import pprint
+import re  # noqa: F401
+
+import six
+
+from openapi_client.configuration import Configuration
+
+
+class NamedEntity(object):
+    """NOTE: This class is auto generated by OpenAPI Generator.
+    Ref: https://openapi-generator.tech
+
+    Do not edit the class manually.
+    """
+
+    """
+    Attributes:
+      openapi_types (dict): The key is attribute name
+                            and the value is attribute type.
+      attribute_map (dict): The key is attribute name
+                            and the value is json key in definition.
+    """
+    openapi_types = {
+        'name': 'str',
+        'id': 'str'
+    }
+
+    attribute_map = {
+        'name': 'name',
+        'id': 'id'
+    }
+
+    def __init__(self, name=None, id=None, local_vars_configuration=None):  # noqa: E501
+        """NamedEntity - a model defined in OpenAPI"""  # noqa: E501
+        if local_vars_configuration is None:
+            local_vars_configuration = Configuration()
+        self.local_vars_configuration = local_vars_configuration
+
+        self._name = None
+        self._id = None
+        self.discriminator = None
+
+        self.name = name
+        self.id = id
+
+    @property
+    def name(self):
+        """Gets the name of this NamedEntity.  # noqa: E501
+
+
+        :return: The name of this NamedEntity.  # noqa: E501
+        :rtype: str
+        """
+        return self._name
+
+    @name.setter
+    def name(self, name):
+        """Sets the name of this NamedEntity.
+
+
+        :param name: The name of this NamedEntity.  # noqa: E501
+        :type: str
+        """
+        if self.local_vars_configuration.client_side_validation and name is None:  # noqa: E501
+            raise ValueError("Invalid value for `name`, must not be `None`")  # noqa: E501
+
+        self._name = name
+
+    @property
+    def id(self):
+        """Gets the id of this NamedEntity.  # noqa: E501
+
+
+        :return: The id of this NamedEntity.  # noqa: E501
+        :rtype: str
+        """
+        return self._id
+
+    @id.setter
+    def id(self, id):
+        """Sets the id of this NamedEntity.
+
+
+        :param id: The id of this NamedEntity.  # noqa: E501
+        :type: str
+        """
+        if self.local_vars_configuration.client_side_validation and id is None:  # noqa: E501
+            raise ValueError("Invalid value for `id`, must not be `None`")  # noqa: E501
+
+        self._id = id
+
+    def to_dict(self):
+        """Returns the model properties as a dict"""
+        result = {}
+
+        for attr, _ in six.iteritems(self.openapi_types):
+            value = getattr(self, attr)
+            if isinstance(value, list):
+                result[attr] = list(map(
+                    lambda x: x.to_dict() if hasattr(x, "to_dict") else x,
+                    value
+                ))
+            elif hasattr(value, "to_dict"):
+                result[attr] = value.to_dict()
+            elif isinstance(value, dict):
+                result[attr] = dict(map(
+                    lambda item: (item[0], item[1].to_dict())
+                    if hasattr(item[1], "to_dict") else item,
+                    value.items()
+                ))
+            else:
+                result[attr] = value
+
+        return result
+
+    def to_str(self):
+        """Returns the string representation of the model"""
+        return pprint.pformat(self.to_dict())
+
+    def __repr__(self):
+        """For `print` and `pprint`"""
+        return self.to_str()
+
+    def __eq__(self, other):
+        """Returns true if both objects are equal"""
+        if not isinstance(other, NamedEntity):
+            return False
+
+        return self.to_dict() == other.to_dict()
+
+    def __ne__(self, other):
+        """Returns true if both objects are not equal"""
+        if not isinstance(other, NamedEntity):
+            return True
+
+        return self.to_dict() != other.to_dict()

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/cloud_resource.py

@@ -1,4 +1,5 @@
 import difflib
+import json
 import pprint
 from typing import Any, Dict, List, Optional
 
@@ -45,6 +46,8 @@ from anyscale.utils.s3 import verify_s3_access
 # It should go away with the SSM refactor.
 DEFAULT_RAY_IAM_ROLE = "ray-autoscaler-v1"
 
+S3_ARN_PREFIX = "arn:aws:s3:::"
+
 
 def compare_dicts_diff(d1: Dict[Any, Any], d2: Dict[Any, Any]) -> str:
     """Returns a string representation of the difference of the two dictionaries.
@@ -836,10 +839,56 @@ def verify_aws_efs(  # noqa: PLR0911, PLR0912, C901
         else:
             raise e
 
+    # Verify efs policy
+    if not _verify_aws_efs_policy(
+        boto3_session, cloud_resource.aws_efs_id, logger, strict
+    ):
+        return False
+
     logger.info(f"EFS {cloud_resource.aws_efs_id} verification succeeded.")
     return True
 
 
+def _verify_aws_efs_policy(
+    boto3_session: boto3.Session,
+    efs_id: str,
+    logger: CloudSetupLogger,
+    strict: bool = False,
+) -> bool:
+    """
+    Verify that the EFS policy has sufficient permissions.
+    """
+    client = boto3_session.client("efs")
+
+    efs_policy = None
+    try:
+        efs_policy_response = client.describe_file_system_policy(FileSystemId=efs_id)
+        efs_policy = json.loads(efs_policy_response["Policy"])
+    except ClientError as e:
+        if e.response["Error"]["Code"] != "PolicyNotFound":
+            # If the policy is not found, we'll skip the check
+            logger.error(f"Failed to describe file system policy: {e}")
+            return False
+
+    if efs_policy:
+        expected_actions = [
+            "elasticfilesystem:ClientRootAccess",
+            "elasticfilesystem:ClientWrite",
+            "elasticfilesystem:ClientMount",
+        ]
+        actions = filter_actions_from_policy_document(efs_policy)
+        missing_actions = set(expected_actions) - set(actions)
+        if missing_actions:
+            logger.warning(
+                f"EFS {efs_id} does not have sufficient permissions. "
+                f"We suggest adding these actions to ensure that efs works properly: {missing_actions}. "
+            )
+            if strict:
+                return False
+
+    return True
+
+
 def verify_aws_cloudformation_stack(
     cloud_resource: CreateCloudResource,
     boto3_session: boto3.Session,

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/controllers/cloud_controller.py

@@ -49,6 +49,7 @@ from anyscale.cloud import (
 )
 from anyscale.cloud_resource import (
     associate_aws_subnets_with_azs,
+    S3_ARN_PREFIX,
     verify_aws_cloudformation_stack,
     verify_aws_efs,
     verify_aws_iam_roles,
@@ -1562,6 +1563,11 @@ class CloudController(BaseController):
                 "Cloud registration requires valid AWS credentials to be set locally. Learn more: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html"
             )
 
+        # We accept both the full ARN and the bucket name as input
+        # but we unify it to the bucket name here
+        if s3_bucket_id.startswith(S3_ARN_PREFIX):
+            s3_bucket_id = s3_bucket_id[len(S3_ARN_PREFIX) :]
+
         self.cloud_event_producer.init_trace_context(
             CloudAnalyticsEventCommandName.REGISTER, CloudProviders.AWS
         )
@@ -1903,6 +1909,10 @@ class CloudController(BaseController):
                 credentials_dict["host_project_id"] = host_project_id
             credentials = json.dumps(credentials_dict)
 
+            # NOTE: For now we set the is_private_service_cloud to be the same as is_private_cloud
+            # We don't expose this to the user yet since it's not recommended.
+            is_private_service_cloud = private_network
+
             created_cloud = self.api_client.create_cloud_api_v2_clouds_post(
                 write_cloud=WriteCloud(
                     provider="GCP",
@@ -1912,6 +1922,7 @@ class CloudController(BaseController):
                     is_bring_your_own_resource=True,
                     is_private_cloud=private_network,
                     cluster_management_stack_version=cluster_management_stack_version,
+                    is_private_service_cloud=is_private_service_cloud,
                 )
             )
             cloud_id = created_cloud.result.id
@@ -1967,6 +1978,7 @@ class CloudController(BaseController):
                 cloud_id=cloud_id,
                 yes=yes,
                 factory=factory,
+                is_private_service_cloud=is_private_service_cloud,
             ):
                 raise ClickException(
                     "Please make sure all the resources provided meet the requirements and try again."

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale/controllers/fine_tune_controller.py

@@ -94,5 +94,5 @@ class FineTuneController(BaseController):
             create_fine_tuning_job_request
         ).result
         self.log.info(
-            f'View the job in the UI at {get_endpoint(f"/fine-tuning-jobs/{ft_job.id}")}'
+            f'View the job in the UI at {get_endpoint(f"/fine-tuning/{ft_job.id}")}'
         )

anyscale-0.5.166/anyscale/version.py

@@ -0,0 +1 @@
+__version__ = "0.5.166"

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: anyscale
-Version: 0.5.165
+Version: 0.5.166
 Summary: Command Line Interface for Anyscale
 Author: Anyscale Inc.
 License: AS License

{anyscale-0.5.165 → anyscale-0.5.166}/anyscale.egg-info/SOURCES.txt

@@ -414,6 +414,7 @@ anyscale/client/openapi_client/models/minibuild_list_response.py
 anyscale/client/openapi_client/models/minicomputetemplate_list_response.py
 anyscale/client/openapi_client/models/miniproject_list_response.py
 anyscale/client/openapi_client/models/monitor_logs_extension.py
+anyscale/client/openapi_client/models/named_entity.py
 anyscale/client/openapi_client/models/network_interface.py
 anyscale/client/openapi_client/models/node_registration_aws.py
 anyscale/client/openapi_client/models/node_registration_gcp.py
@@ -1288,6 +1289,7 @@ tests/../anyscale/client/openapi_client/models/minibuild_list_response.py
 tests/../anyscale/client/openapi_client/models/minicomputetemplate_list_response.py
 tests/../anyscale/client/openapi_client/models/miniproject_list_response.py
 tests/../anyscale/client/openapi_client/models/monitor_logs_extension.py
+tests/../anyscale/client/openapi_client/models/named_entity.py
 tests/../anyscale/client/openapi_client/models/network_interface.py
 tests/../anyscale/client/openapi_client/models/node_registration_aws.py
 tests/../anyscale/client/openapi_client/models/node_registration_gcp.py

{anyscale-0.5.165 → anyscale-0.5.166}/tests/controllers/test_cloud_controller.py

@@ -597,12 +597,21 @@ def test_list_cloud(
 @pytest.mark.parametrize("verify_success", [True, False])
 @pytest.mark.parametrize("private_network", [True, False])
 @pytest.mark.parametrize("enable_head_node_fault_tolerance", [True, False])
+@pytest.mark.parametrize(
+    ("s3_id_input", "s3_id_expected"),
+    [
+        pytest.param("s3-bucket-name", "s3-bucket-name"),
+        pytest.param("arn:aws:s3:::bucket-name", "bucket-name"),
+    ],
+)
 def test_register_cloud_aws(
     anyscale_iam_role: str,
     anyscale_instance_role: str,
     verify_success: bool,
     private_network: bool,
     enable_head_node_fault_tolerance: bool,
+    s3_id_input: str,
+    s3_id_expected: str,
 ) -> None:
 
     mock_cloud = Mock(result=Mock(id="mock_cloud_id"))
@@ -615,7 +624,7 @@ def test_register_cloud_aws(
     mock_subnet_ids = ["mock_subnet"]
     mock_efs_id = "mock_efs_id"
     mock_security_group_ids = ["security_group_id"]
-    mock_s3_bucket_id = "mock_s3_bucket_id"
+    mock_s3_bucket_id = s3_id_input
     mock_get_role = Mock()
     mock_get_aws_efs_mount_target_ip = Mock(return_value="mock_efs_ip")
     mock_memorydb_cluster_id = (
@@ -713,7 +722,7 @@ def test_register_cloud_aws(
                     aws_subnet_ids_with_availability_zones=mock_subnet_ids_with_azs,
                     aws_iam_role_arns=[anyscale_iam_role, anyscale_instance_role],
                     aws_security_groups=mock_security_group_ids,
-                    aws_s3_id=mock_s3_bucket_id,
+                    aws_s3_id=s3_id_expected,
                     aws_efs_id=mock_efs_id,
                     aws_efs_mount_target_ip="mock_efs_ip",
                     memorydb_cluster_config=mock_memorydb_cluster_config,
@@ -868,6 +877,7 @@ def test_register_cloud_gcp(
             is_bring_your_own_resource=True,
             is_private_cloud=private_network,
             cluster_management_stack_version=cluster_management_stack_version,
+            is_private_service_cloud=private_network,
         )
     )
 

{anyscale-0.5.165 → anyscale-0.5.166}/tests/test_cloud_resource.py

@@ -32,6 +32,7 @@ from anyscale.client.openapi_client.models.subnet_id_with_availability_zone_aws
     SubnetIdWithAvailabilityZoneAWS,
 )
 from anyscale.cloud_resource import (
+    _verify_aws_efs_policy,
     is_internal_communication_allowed,
     verify_aws_cloudformation_stack,
     verify_aws_efs,
@@ -1237,22 +1238,88 @@ def test_verify_aws_efs(
         cloud_resource_mock.aws_security_groups = [security_group_id]
         cloud_resource_mock.aws_efs_id = efs_id
 
-    result = verify_aws_efs(
-        cloud_resource=cloud_resource_mock,
-        boto3_session=boto3.Session(region_name=region),
-        logger=CloudSetupLogger(),
+    with patch.multiple(
+        "anyscale.cloud_resource", _verify_aws_efs_policy=Mock(return_value=True),
+    ):
+        result = verify_aws_efs(
+            cloud_resource=cloud_resource_mock,
+            boto3_session=boto3.Session(region_name=region),
+            logger=CloudSetupLogger(),
+        )
+        _, stderr = capsys.readouterr()
+        if warning:
+            assert re.search(r"does not contain a mount target with the subnet", stderr)
+        if enable_backup:
+            assert not re.search(r"backup policy is not enabled", stderr)
+            assert not re.search(r"backup policy not found", stderr)
+        else:
+            assert re.search(r"backup policy is not enabled", stderr) or re.search(
+                r"backup policy not found", stderr
+            )
+        assert result == expected_result
+
+
+@pytest.mark.parametrize("strict", [True, False])
+@pytest.mark.parametrize(
+    "policy",
+    [
+        None,
+        [
+            "elasticfilesystem:ClientRootAccess",
+            "elasticfilesystem:ClientWrite",
+            "elasticfilesystem:ClientMount",
+        ],
+        ["elasticfilesystem:ClientWrite", "elasticfilesystem:ClientMount"],
+    ],
+)
+def test_verify_aws_efs_policy(strict: bool, policy: Optional[List[str]], capsys):
+    mock_boto3 = Mock()
+    efs_id = "mock-efs"
+
+    mock_efs_client = Mock()
+    if policy:
+        mock_policy_dict = {
+            "Version": "2012-10-17",
+            "Id": "efs-policy",
+            "Statement": [
+                {
+                    "Sid": "efs-statement",
+                    "Effect": "Allow",
+                    "Principal": {"AWS": "*"},
+                    "Action": policy,
+                    "Condition": {
+                        "Bool": {"elasticfilesystem:AccessedViaMountTarget": "true"}
+                    },
+                }
+            ],
+        }
+        mock_efs_client.describe_file_system_policy = Mock(
+            return_value={"Policy": json.dumps(mock_policy_dict)}
+        )
+    else:
+        mock_efs_client.describe_file_system_policy = Mock(
+            side_effect=ClientError(
+                error_response={"Error": {"Code": "PolicyNotFound"}},
+                operation_name="describe_file_system_policy",
+            )
+        )
+
+    mock_boto3.client = Mock(return_value=mock_efs_client)
+    verification_result = _verify_aws_efs_policy(
+        mock_boto3, efs_id, CloudSetupLogger(), strict
     )
+
     _, stderr = capsys.readouterr()
-    if warning:
-        assert re.search(r"does not contain a mount target with the subnet", stderr)
-    if enable_backup:
-        assert not re.search(r"backup policy is not enabled", stderr)
-        assert not re.search(r"backup policy not found", stderr)
+    if not policy:
+        assert verification_result is True
+        assert "does not have sufficient permissions" not in stderr
     else:
-        assert re.search(r"backup policy is not enabled", stderr) or re.search(
-            r"backup policy not found", stderr
-        )
-    assert result == expected_result
+        if len(policy) == 3:
+            assert verification_result is True
+            assert "does not have sufficient permissions" not in stderr
+        else:
+            assert verification_result == (not strict)
+            assert "does not have sufficient permissions" in stderr
 
 
 @pytest.mark.parametrize(
@@ -1297,11 +1364,14 @@ def test_verify_aws_efs_valid_ip(
     else:
         cloud_resource_mock.aws_efs_mount_target_ip = "1.2.3.4"
 
-    result = verify_aws_efs(
-        cloud_resource=cloud_resource_mock,
-        boto3_session=boto3.Session(region_name=region),
-        logger=CloudSetupLogger(),
-    )
+    with patch.multiple(
+        "anyscale.cloud_resource", _verify_aws_efs_policy=Mock(return_value=True),
+    ):
+        result = verify_aws_efs(
+            cloud_resource=cloud_resource_mock,
+            boto3_session=boto3.Session(region_name=region),
+            logger=CloudSetupLogger(),
+        )
 
     stdout, stderr = capsys.readouterr()
     sys.stdout.write(stdout)

anyscale-0.5.165/anyscale/version.py

@@ -1 +0,0 @@
-__version__ = "0.5.165"