AWS batch documentation change
Summary
Added Task properties section with Execution role configuration and ECS execute command guidance for multi-node jobs
Security assessment
Expands security documentation for multi-node jobs with IAM roles and ECS execute command requirements, but no vulnerability addressed.
Diff
diff --git a/batch/latest/userguide/multi-node-job-def-ec2.md b/batch/latest/userguide/multi-node-job-def-ec2.md index 310bcc37e..3db10fb83 100644 --- a//batch/latest/userguide/multi-node-job-def-ec2.md +++ b//batch/latest/userguide/multi-node-job-def-ec2.md @@ -167 +167,17 @@ Only roles that have the **Amazon Elastic Container Service Task Role** trust re - 26. (Optional) In the **Logging configuration** section: + 26. In the **Task properties** section: + + 1. For **Execution role - conditional** , choose a role to allow Amazon ECS agents to make AWS API calls on your behalf. For more information on creating an **Execution role** , see [Tutorial: Create the IAM execution role](./create-execution-role.html). + + 2. ###### Important + +To use **ECS execute command** your compute environment must meet the [compute environment considerations for multi node parallel jobs](./mnp-ce.html). + +Choose **Enable ECS execute command** , to enable access to the Amazon ECS container shell directly and bypass the host OS. You must choose a **Task role**. + +###### Important + +The **ECS execute** command requires that file system be writable. + + 3. For **Task role** , choose an Amazon ECS Identity and Access Management (IAM) role to allow the container to make AWS API calls on your behalf. For more information see, [Amazon ECS task IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) in the _Amazon Elastic Container Service Developer Guide_. + + 27. (Optional) In the **Logging configuration** section: @@ -183 +199 @@ For more information, see [LogConfiguration:secretOptions](https://docs.aws.amaz - 27. Choose **Next page**. + 28. Choose **Next page**. @@ -185 +201 @@ For more information, see [LogConfiguration:secretOptions](https://docs.aws.amaz - 28. For **Job definition review** , review the configuration steps. If you need to make changes, choose **Edit**. When you're finished, choose **Create job definition**. + 29. For **Job definition review** , review the configuration steps. If you need to make changes, choose **Edit**. When you're finished, choose **Create job definition**.