AWS AmazonECS documentation change
Summary
Updated service creation steps with restructured sections, added VPC Lattice integration details, expanded network configuration guidance (security groups, subnets, public IPs), and clarified service discovery/load balancing options
Security assessment
Added explicit guidance about security group configuration (creating inbound rules) and network security considerations (private subnets, NAT gateway requirements). While these are security-related configurations, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/create-service-console-v2.md b/AmazonECS/latest/developerguide/create-service-console-v2.md index a59fa4eea..df87b31a8 100644 --- a/AmazonECS/latest/developerguide/create-service-console-v2.md +++ b/AmazonECS/latest/developerguide/create-service-console-v2.md @@ -95 +95 @@ To deploy a service using the default parameters follow these steps. - 5. Under **Deployment configuration** , specify how your application is deployed. +The **Create service** page appears. @@ -97 +97 @@ To deploy a service using the default parameters follow these steps. - 1. For **Application type** , choose **Service**. + 5. Under **Service details** , do the following: @@ -99 +99 @@ To deploy a service using the default parameters follow these steps. - 2. For **Task definition** , choose the task definition family and revision to use. + 1. For **Task definition** , enter the task definition family and revision to use. @@ -101 +101 @@ To deploy a service using the default parameters follow these steps. - 3. For **Service name** , enter a name for your service. + 2. For **Service name** , enter a name for your service. @@ -103 +103 @@ To deploy a service using the default parameters follow these steps. - 4. For **Desired tasks** , enter the number of tasks to launch and maintain in the service. + 6. Under **Deployment configuration** , do the following: @@ -105 +105,3 @@ To deploy a service using the default parameters follow these steps. - 6. (Optional) To help identify your service and tasks, expand the **Tags** section, and then configure your tags. + 1. For **Desired tasks** , enter the number of tasks to launch and maintain in the service. + + 7. (Optional) To help identify your service and tasks, expand the **Tags** section, and then configure your tags. @@ -139 +141 @@ Clusters | -Launch type | +Task definition | @@ -143 +145,7 @@ Launch type | - 3. (Optional) Choose how your tasks are distributed across your cluster infrastructure. Expand **Compute configuration** , and then choose your option. +The **Create service** page appears. + + 3. For **Existing cluster** , choose the cluster. + +Choose **Create cluster** to run the task on a new cluster + + 4. Choose how your tasks are distributed across your cluster infrastructure. Under **Compute configuration** , choose your option. @@ -145 +153 @@ Launch type | -Distribution method | Steps +Compute option | Steps @@ -161 +169 @@ Launch type | - 4. To specify how your service is deployed, go to the **Deployment configuration** section, and then choose your options. + 5. Under **Deployment configuration** , do the following: @@ -163 +171 @@ Launch type | - 1. For **Application type** , leave the choice as **Service**. + 1. For **Task definition** , enter the task definition to use. Then, for **Revision** , choose the revision to use. @@ -165 +173 @@ Launch type | - 2. For **Task definition** and **Revision** , choose the task definition family and revision to use. + 2. For **Service name** , enter a name for your service. @@ -167,3 +175 @@ Launch type | - 3. For **Service name** , enter a name for your service. - - 4. For **Service type** , choose the service scheduling strategy. + 3. For **Service type** , choose the service scheduling strategy. @@ -175 +181,3 @@ Launch type | - 5. If you chose **Replica** , for **Desired tasks** , enter the number of tasks to launch and maintain in the service. + 4. If you chose **Replica** , for **Desired tasks** , enter the number of tasks to launch and maintain in the service. + + 5. If you chose **Replica** , to have Amazon ECS monitor the distribution of tasks across Availability Zones, and redistribute them when there is an imbalance, under **Availability Zone service rebalancing** , select **Availability Zone service rebalancing**. @@ -177 +185 @@ Launch type | - 6. If you chose **Replica** , to have Amazon ECS monitor the distribution of tasks across Availability Zones, and redistribute them when there is an imbalance, under **Availability Zone service rebalancing** , select **Availability Zone service rebalancing**. + 6. For **Health check grace period** , enter the amount of time (in seconds) that the enter the amount of time (in seconds) that the service scheduler ignores unhealthy Elastic Load Balancing, VPC Lattice, and container health checks after a task has first started. If you do not specify a health check grace period value, the default value of 0 is used. @@ -200 +208,5 @@ To have the software automatically roll back the deployment to the last complete - 5. (Optional) To use Service Connect, select **Turn on Service Connect** , and then specify the following: + 6. If your task definition uses the `awsvpc` network mode, you can specify a custom network configuration expand **Networking** , and then do the following to. + + 1. For **VPC** , select the VPC to use. + + 2. For **Subnets** , select one or more subnets in the VPC that the task scheduler considers when placing your tasks. @@ -202 +214,15 @@ To have the software automatically roll back the deployment to the last complete - 1. Under **Service Connect configuration** , specify the client mode. +###### Important + +Only private subnets are supported for the `awsvpc` network mode. Tasks don't receive public IP addresses. Therefore, a NAT gateway is required for outbound internet access, and inbound internet traffic is routed through a load balancer. + + 3. For **Security group** , you can either select an existing security group or create a new one. To use an existing security group, select the security group and move to the next step. To create a new security group, choose **Create a new security group**. You must specify a security group name, description, and then add one or more inbound rules for the security group. + + 4. For **Public IP** , choose whether to auto-assign a public IP address to the elastic network interface (ENI) of the task. + +AWS Fargate tasks can be assigned a public IP address when run in a public subnet so they have a route to the internet. EC2 tasks can't be assigned a public IP using this field. For more information, see [Amazon ECS task networking options for the Fargate launch type](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-task-networking.html) and [Allocate a network interface for an Amazon ECS task](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking-awsvpc.html). + + 7. (Optional) To interconnect you service using Service Connect, expand **Service Connect** , and then specify the following: + + 1. Select **Turn on Service Connect**. + + 2. Under **Service Connect configuration** , specify the client mode. @@ -208 +234 @@ To have the software automatically roll back the deployment to the last complete - 2. To use a namespace that is not the default cluster namespace, for **Namespace** , choose the service namespace. + 3. To use a namespace that is not the default cluster namespace, for **Namespace** , choose the service namespace. @@ -210 +236 @@ To have the software automatically roll back the deployment to the last complete - 3. (Optional) Select the **Use log collection** option to specify a log configuration. For each available log driver, there are log driver options to specify. The default option sends container logs to CloudWatch Logs. The other log driver options are configured using AWS FireLens. For more information, see [Send Amazon ECS logs to an AWS service or AWS Partner](./using_firelens.html). + 4. (Optional) Specify a log configuration. Select **Use log collection**. The default option sends container logs to CloudWatch Logs. The other log driver options are configured using AWS FireLens. For more information, see [Send Amazon ECS logs to an AWS service or AWS Partner](./using_firelens.html). @@ -224 +250 @@ The following describes each container log destination in more detail. - 6. (Optional) To use Service Discovery, select **Use service discovery** , and then specify the following. + 8. (Optional) To interconnect you service using Service Discovery, expand **Service discovery** , and then do the following. @@ -226 +252 @@ The following describes each container log destination in more detail. - 1. To use a new namespace, choose **Create a new namespace** under **Configure namespace** , and then provide a namespace name and description. To use an existing namespace, choose **Select an existing namespace** and then choose the namespace that you want to use. + 1. Select **Use service discovery**. @@ -228 +254 @@ The following describes each container log destination in more detail. - 2. Provide Service Discovery service information such as the service's name and description. + 2. To use a new namespace, choose **Create a new namespace** under **Configure namespace** , and then provide a namespace name and description. To use an existing namespace, choose **Select an existing namespace** and then choose the namespace that you want to use. @@ -230 +256 @@ The following describes each container log destination in more detail. - 3. To have Amazon ECS perform periodic container-level health checks, select **Enable Amazon ECS task health propagation**. + 3. Provide Service Discovery service information such as the service's name and description. @@ -232 +258,3 @@ The following describes each container log destination in more detail. - 4. For **DNS record type** , select the DNS record type to create for your service. Amazon ECS service discovery only supports **A** and **SRV** records, depending on the network mode that your task definition specifies. For more information about these record types, see [Supported DNS Record Types](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html) in the _Amazon Route 53 Developer Guide_. + 4. To have Amazon ECS perform periodic container-level health checks, select **Enable Amazon ECS task health propagation**. + + 5. For **DNS record type** , select the DNS record type to create for your service. Amazon ECS service discovery only supports **A** and **SRV** records, depending on the network mode that your task definition specifies. For more information about these record types, see [Supported DNS Record Types](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html) in the _Amazon Route 53 Developer Guide_. @@ -240 +268,21 @@ For **TTL** , enter the time in seconds how long a record set is cached by DNS r - 7. (Optional) To configure a load balancer for your service, expand **Load balancing**. + 9. (Optional) To interconnect you service using VPC Lattice, xxpand **VPC Lattice** , and then do the following: + + 1. Select **Turn on VPC Lattice** + + 2. For **Infrastructure role** , choose the infrastructure role. + +If you haven't created a role, choose **Create infrastructure role**. + + 3. Under **Target Groups** choose the target group or groups. You need to choose at least one target group and can have a maximum of five. Choose **Add target group** to add additional target groups. Choose the **Port name** , **Protocol** , and **Port** for each target group you chose. + +To delete a target group, choose **Remove**. + +###### Note + + * If you want to add existing target groups, you need use the AWS CLI. For instructions on how to add target groups using the AWS CLI, see [register-targets ](https://docs.aws.amazon.com/cli/latest/reference/vpc-lattice/register-targets.html) in the _AWS Command Line Interface Reference_. + + * While a VPC Lattice service can have multiple target groups, each target group can only be added to one service. + + 4. To complete the VPC Lattice configuration, by including your new target groups in the listener default action or in the rules of an existing VPC Lattice service in the VPC Lattice console. For more information, see [Listener rules for your VPC Lattice service](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listener-rules.html). + + 10. (Optional) To configure a load balancer for your service, expand **Load balancing**. @@ -255 +302,0 @@ Application Load Balancer | - 9. For **Health check grace period** , enter the amount of time (in seconds) that the service scheduler should ignore unhealthy Elastic Load Balancing target health checks. @@ -263,17 +309,0 @@ Network Load Balancer | - 7. For **Health check grace period** , enter the amount of time (in seconds) that the service scheduler should ignore unhealthy Elastic Load Balancing target health checks. - - 8. (Optional) To use VPC Lattice, select **Turn on VPC Lattice** , and then specify the following: - - 1. For **Infrastructure role** , choose the infrastructure role. - -If you haven't created a role, choose **Create infrastructure role**. - - 2. Under **Target Groups** choose the target group or groups. You need to choose at least one target group and can have a maximum of five. Choose **Add target group** to add additional target groups. Choose the **Port name** , **Protocol** , and **Port** for each target group you chose. - -To delete a target group, choose **Remove**. - -###### Note - - * If you want to add existing target groups, you need use the AWS CLI. For instructions on how to add target groups using the AWS CLI, see [register-targets ](https://docs.aws.amazon.com/cli/latest/reference/vpc-lattice/register-targets.html) in the _AWS Command Line Interface Reference_. - - * While a VPC Lattice service can have multiple target groups, each target group can only be added to one service. @@ -281,3 +311 @@ To delete a target group, choose **Remove**. - 3. To complete the VPC Lattice configuration, by including your new target groups in the listener default action or in the rules of an existing VPC Lattice service in the VPC Lattice console. For more information, see [Listener rules for your VPC Lattice service](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listener-rules.html). - - 9. (Optional) To configure service Auto Scaling, expand **Service auto scaling** , and then specify the following parameters.To use predicte auto scaling, which looks at past load data from traffic flows, configure it after you create the service. For more information, see [Use historical patterns to scale Amazon ECS services with predictive scaling](./predictive-auto-scaling.html). + 11. (Optional) To configure service Auto Scaling, expand **Service auto scaling** , and then specify the following parameters.To use predicte auto scaling, which looks at past load data from traffic flows, configure it after you create the service. For more information, see [Use historical patterns to scale Amazon ECS services with predictive scaling](./predictive-auto-scaling.html). @@ -323 +351 @@ Step scaling | - 10. (Optional) To use a task placement strategy other than the default, expand **Task Placement** , and then choose from the following options. + 12. (Optional) To use a task placement strategy other than the default, expand **Task Placement** , and then choose from the following options. @@ -349,17 +377 @@ You can enter a maximum of 10 constraints. - 11. If your task definition uses the `awsvpc` network mode, expand **Networking**. Use the following steps to specify a custom configuration. - - 1. For **VPC** , select the VPC to use. - - 2. For **Subnets** , select one or more subnets in the VPC that the task scheduler considers when placing your tasks. - -###### Important - -Only private subnets are supported for the `awsvpc` network mode. Tasks don't receive public IP addresses. Therefore, a NAT gateway is required for outbound internet access, and inbound internet traffic is routed through a load balancer. - - 3. For **Security group** , you can either select an existing security group or create a new one. To use an existing security group, select the security group and move to the next step. To create a new security group, choose **Create a new security group**. You must specify a security group name, description, and then add one or more inbound rules for the security group. - - 4. For **Public IP** , choose whether to auto-assign a public IP address to the elastic network interface (ENI) of the task. - -AWS Fargate tasks can be assigned a public IP address when run in a public subnet so they have a route to the internet. EC2 tasks can't be assigned a public IP using this field. For more information, see [Amazon ECS task networking options for the Fargate launch type](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-task-networking.html) and [Allocate a network interface for an Amazon ECS task](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking-awsvpc.html). - - 12. If your task uses a data volume that's compatible with configuration at deployment, you can configure the volume by expanding **Volume**. + 13. If your task uses a data volume that's compatible with configuration at deployment, you can configure the volume by expanding **Volume**. @@ -383 +395 @@ Amazon EBS | - 13. (Optional) To help identify your service and tasks, expand the **Tags** section, and then configure your tags. + 14. (Optional) To help identify your service and tasks, expand the **Tags** section, and then configure your tags. @@ -399 +411 @@ Add or remove a tag. - 14. Choose **Create**. + 15. Choose **Create**. @@ -405,0 +418,2 @@ Add or remove a tag. +The following are additional actions after you create a service. +