AWS batch documentation change
Summary
Added Task properties section with Execution role configuration and ECS execute command guidance
Security assessment
The changes add documentation about IAM roles (Execution role and Task role) and security considerations for ECS execute command (requires writable filesystem). While these are security-related configurations, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/batch/latest/userguide/create-job-definition-EC2.md b/batch/latest/userguide/create-job-definition-EC2.md index fe7eff867..a48074ee6 100644 --- a//batch/latest/userguide/create-job-definition-EC2.md +++ b//batch/latest/userguide/create-job-definition-EC2.md @@ -137 +137,13 @@ To maximize your resource utilization, prioritize memory for jobs of a specific - 21. (Optional) In the **Logging configuration** section: + 21. In the **Task properties** section: + + 1. For **Execution role - conditional** , choose a role to allow Amazon ECS agents to make AWS API calls on your behalf. For more information on creating an **Execution role** , see [Tutorial: Create the IAM execution role](./create-execution-role.html). + + 2. Choose **Enable ECS execute command** , to enable access to the Amazon ECS container shell directly and bypass the host OS. You must choose a **Task role**. + +###### Important + +The **ECS execute** command requires that file system be writable. + + 3. For **Task role** , choose an Amazon ECS Identity and Access Management (IAM) role to allow the container to make AWS API calls on your behalf. For more information see, [Amazon ECS task IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) in the _Amazon Elastic Container Service Developer Guide_. + + 22. (Optional) In the **Logging configuration** section: @@ -153 +165 @@ For more information, see [LogConfiguration:secretOptions](https://docs.aws.amaz - 22. Choose **Next page**. + 23. Choose **Next page**. @@ -155 +167 @@ For more information, see [LogConfiguration:secretOptions](https://docs.aws.amaz - 23. For **Job definition review** , review the configuration steps. If you need to make changes, choose **Edit**. When you're finished, choose **Create job definition**. + 24. For **Job definition review** , review the configuration steps. If you need to make changes, choose **Edit**. When you're finished, choose **Create job definition**.