AWS AmazonECS documentation change
Summary
Added multiple new IAM context keys for granular permissions control
Security assessment
Documents new IAM policy condition keys related to security controls (KMS, account settings, etc.), enhancing security documentation without addressing a specific vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/security_iam_service-with-iam.md index 16c06ae61..7215a7ad0 100644 --- a/AmazonECS/latest/developerguide/security_iam_service-with-iam.md +++ b/AmazonECS/latest/developerguide/security_iam_service-with-iam.md @@ -154,0 +155,3 @@ ecs:ResourceTag/${TagKey} | The context key is formatted `"ecs:ResourceTag/`tag +ecs:account-setting | he context key is formatted `"ecs:account-setting":"`account-setting`"` where `account-setting` is the name of the account setting. | String +ecs:auto-assign-public-ip | The context key is formatted `"ecs:auto-assign-public-ip":"`value`"` where `value-` is "`true`" or "`false`". | String +ecs:capacity-provider | The context key is formatted `"ecs:capacity-provider":"`capacity-provider-arn`"` where `capacity-provider-arn` is the ARN for the capacity provider. | ARN, Null @@ -155,0 +159 @@ ecs:cluster | The context key is formatted `"ecs:cluster":"`cluster-arn`"` wher +ecs:compute-compatability | The context key is formatted `"ecs:compute-compatability":"`compatability-type`"` where ``compatability-type`` is "`FARGATE`", "`EC2`" or "`EXTERNAL`". | String @@ -160,0 +165,3 @@ ecs:enable-ebs-volumes | The context key is formatted `"ecs:enable-ebs-volumes" +ecs:enable-managed-tags | The context key is formatted `"ecs:enable-managed-tags":"`value`"` where `value` is `"true"` or `"false"`. | String +ecs:enable-vpc-lattice | The context key is formatted `"ecs:vpc-lattice":"`value`"` where `value` is `"true"` or `"false"`. | String +ecs:fargate-ephemeral-storage-kms-key | The context key is formatted `"ecs:fargate-ephemeral-storage-kms-key":"`key`"` where `key` is the ID of the AWS KMS key. | String @@ -161,0 +169 @@ ecs:namespace | The context key is formatted `"ecs:namespace":"`namespace-arn`" +ecs:propagate-tags | The context key is formatted `"ecs:propagate-tags":"`value`"` where `value` is `"TASK_DEFINITION"`, `"SERVICE"`, or `"NONE"`. | String @@ -164 +172,4 @@ ecs:task-definition | The context key is formatted `"ecs:task-definition":"`tas -ecs:account-setting | The context key is formatted `"ecs:account-setting":"`account-setting`"` where `account-setting` is the name of an Amazon ECS account setting. | String +ecs:subnet | The context key is formatted `"ecs:subnet":"`subnets`"` where `subnets` are the subnets of a task or service that uses `awsvpc` mode. | String +ecs:task | The context key is formatted `"ecs:task":"`task-arn`"` where `task-arn` is the ARN for the Amazon ECS service. | ARN, Null +ecs:task-cpu | The context key is formatted `"ecs:task-cpu":"`task-cpu`"` where `task-cpu` is the task cpu, as an integer with 1024 = 1 vCPU. | Integer +ecs:task-memory | The context key is formatted `"ecs:task-memory":"`task-memory`"` where `task-memory` is the task memory in MiB. | Integer