Sub-accounts

​

Steps to enable trusted access

1. Sign in to AWS Console using management account credentials
2. Navigate to AWS Organizations
3. Select “Services” in the navigation pane
4. Find “AWS Account Management” in the services list
5. Click “Enable trusted access”
6. In the confirmation dialog, type “enable”

​

Steps to create a sub-account

1. Visit the Organisations control panel in - https://us-east-1.console.aws.amazon.com/organizations/v2/home/accounts
2. Click “Add an AWS account”
3. Select “Create an AWS account”
4. Enter account details:
   • Account name: “Tensorfuse-Platform”
   • Email:
     • We are using the Google Workspace’s + feature to create email. So, if your infra person’s email is infra@yourcompany.io then use the below email
     • infra+tensorfuse@yourcompany.io - This will forward all the emails to infra@yourcompany.io
   • IAM role name: “OrganizationAccountAccessRole” (keep default)
5. Remember the email created above. Now that your account is created, sign out of your existing account
6. Go to this link and sign up using the email above - https://signin.aws.amazon.com/
7. Click on forgot password and setup a password and log into the account.

​

Steps to apply for quotas and ready the subaccount for Tensorfuse

• On the top right you will see the account name Tensorfuse-Subaccount with a dropdown. Click on the dropdown.
• Click on Security Credentials . This will take you to the Identity and Access Management
• Create an access key to apply for quotas. Remember this is the root access key so be careful with this.

# Create a new profile for the sub-account
aws configure --profile tensorfuse
# You will be prompted for:
AWS Access Key ID [None]: <your-sub-account-access-key>
AWS Secret Access Key [None]: <your-sub-account-secret-key>
Default region name [None]: us-east-1
Default output format [None]: json

• After this run the following bash script to apply for the required quotas. We will be applying quotas to run CPU instances, G-instances (for A10G, L40S, T4s) and P instances for A100s and H100s in the us-east-1 and the us-east-2 region.

#!/bin/bash

# Set the AWS profile
export AWS_PROFILE=tensorfuse

# Verify correct account before proceeding
ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
echo "Running for AWS Account: $ACCOUNT_ID"
read -p "Is this the correct sub-account? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]
then
    echo "Aborting..."
    exit 1
fi

# Define the quota codes and regions
QUOTA_CODES=(
    "L-417A185B"  # Running On-Demand P instances
    "L-3819A6DF"  # Running On-Demand G and VT instances
    "L-1216C47A"  # Running On-Demand Standard instances
)

REGIONS=(
    "us-east-1"
    "us-east-2"
)

# Loop through each region and quota code
for region in "${REGIONS[@]}"; do
    echo "Processing region: $region"

    for quota_code in "${QUOTA_CODES[@]}"; do
        echo "Requesting quota increase for code: $quota_code"

        aws service-quotas request-service-quota-increase \
            --service-code ec2 \
            --quota-code "$quota_code" \
            --desired-value 200 \
            --region "$region"

        # Wait a bit between requests to avoid throttling
        sleep 2
    done
done