AWS lambda documentation change
Summary
Added note about cloning AWS Marketplace container images to a private ECR repository
Security assessment
The change emphasizes using private repositories for Marketplace images, which aligns with security best practices for controlling image sources. No specific vulnerability is mentioned.
Diff
diff --git a/lambda/latest/dg/images-create.md b/lambda/latest/dg/images-create.md index 1072bd923..ff7040f0b 100644 --- a//lambda/latest/dg/images-create.md +++ b//lambda/latest/dg/images-create.md @@ -32 +32 @@ To reduce the time it takes for Lambda container functions to become active, see -To create a Lambda function from a container image, build your image locally and upload it to an Amazon Elastic Container Registry (Amazon ECR) repository. Then, specify the repository URI when you create the function. The Amazon ECR repository must be in the same AWS Region as the Lambda function. You can create a function using an image in a different AWS account, as long as the image is in the same Region as the Lambda function. For more information, see Amazon ECR cross-account permissions. +To create a Lambda function from a container image, build your image locally and upload it to an Amazon Elastic Container Registry (Amazon ECR) repository. If you're using a container image provided by an [AWS Marketplace](https://docs.aws.amazon.com/marketplace/latest/userguide/container-based-products.html) seller, you need to clone the image to your private Amazon ECR repository first. Then, specify the repository URI when you create the function. The Amazon ECR repository must be in the same AWS Region as the Lambda function. You can create a function using an image in a different AWS account, as long as the image is in the same Region as the Lambda function. For more information, see Amazon ECR cross-account permissions.