AWS AmazonECS documentation change

Service: AmazonECS · 2025-04-25 · Documentation low

File: AmazonECS/latest/developerguide/enable-service-connect-tls.md

Summary

Clarified IAM role requirements for Service Connect TLS and added link to Private CA certificate documentation

Security assessment

The changes improve documentation about security-related TLS configuration and IAM role requirements, but there is no evidence of addressing a specific security vulnerability. The updates enhance clarity around security features rather than patching an issue.

Diff

diff --git a/AmazonECS/latest/developerguide/enable-service-connect-tls.md b/AmazonECS/latest/developerguide/enable-service-connect-tls.md
index edf991d1a..0a75ed9c0 100644
--- a//AmazonECS/latest/developerguide/enable-service-connect-tls.md
+++ b//AmazonECS/latest/developerguide/enable-service-connect-tls.md
@@ -11 +11 @@ You enable traffic encryption when you create or update a Service Connect servic
-  1. There are additional IAM permissions required to issue certificates. Amazon ECS provides a managed resource trust policy that outlines the set of permissions. For more information about this policy, see [AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity                     ).
+  1. You need to have the infrastructure IAM role. For more information about this role, see [Amazon ECS infrastructure IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html                     ).
@@ -25 +25 @@ You enable traffic encryption when you create or update a Service Connect servic
-  8. For **Service Connect TLS role** , choose an existing role or create a new one.
+  8. For **Service Connect TLS role** , choose an existing infrastructure IAM role or create a new one.
@@ -28,0 +29,2 @@ You enable traffic encryption when you create or update a Service Connect servic
+For more information, see see [AWS Private Certificate Authority certificates and Service Connect](./service-connect-tls.html#service-connect-tls-certificates).
+