AWS AmazonECS documentation change
Summary
Updated troubleshooting section to reference GuardDuty console coverage statistics instead of CLI/console tag checks
Security assessment
Improves documentation for existing security feature (Runtime Monitoring) by directing users to GuardDuty coverage stats. No evidence of addressing a specific vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/ecs-guard-duty-troubleshooting.md b/AmazonECS/latest/developerguide/ecs-guard-duty-troubleshooting.md index 9663abf1d..afb23f0d9 100644 --- a/AmazonECS/latest/developerguide/ecs-guard-duty-troubleshooting.md +++ b/AmazonECS/latest/developerguide/ecs-guard-duty-troubleshooting.md @@ -7 +7 @@ How can I tell if Runtime Monitoring is active on my account?How can I tell if R -# Runtime Monitoring Troubleshooting FAQs +# Runtime Monitoring Troubleshooting @@ -57,38 +57 @@ The setting with **name** set to `guardDutyActivate` and **value** set to `on` i -In the Amazon ECS console, the information is on **Tags** tab of the **Cluster** detail page. - -You can also run `describe-clusters` with the `TAGS` option. - -The following example shows the output for the default cluster - - - aws ecs describe-clusters --cluster default --include TAGS - -Output - -The tag with **Key** set to `GuardDutyManaged` and **Value** set to `true` indicates that the cluster is configured for Runtime Monitoring. - - - { - "clusters": [ - { - "clusterArn": "arn:aws:ecs:us-east-1:1234567890:cluster/default", - "clusterName": "default", - "status": "ACTIVE", - "registeredContainerInstancesCount": 0, - "runningTasksCount": 1, - "pendingTasksCount": 0, - "activeServicesCount": 0, - "statistics": [], - "tags": [ - { - **"key": "GuardDutyManaged", - "value": "true"** - } - ], - "settings": [], - "capacityProviders": [], - "defaultCapacityProviderStrategy": [] - } - ], - "failures": [] - } +You can review the coverage statistics in the GuardDuty console. This includes information for the Amazon ECS resources associated with your own account or your member accounts is the percentage of the healthy clusters over all the clusters in the selected AWS Region. This includes the coverage for clusters that use the Fargate and EC2 launch types. For more information, see [Reviewing coverage statistics](https://docs.aws.amazon.com/guardduty/latest/ug/gdu-assess-coverage-ecs.html#ecs-review-coverage-statistics-ecs-runtime-monitoring) in the _Amazon GuardDuty User Guide_.