AWS batch documentation change
Summary
Modified security group documentation for multi-node parallel jobs, clarifying network interface security group behavior
Security assessment
Clarifies security group assignment logic for network interfaces in MNP tasks, explicitly stating default VPC security group usage when none are specified. This improves security documentation but does not indicate a resolved vulnerability.
Diff
diff --git a/batch/latest/userguide/mnp-ce.md b/batch/latest/userguide/mnp-ce.md index cdb992594..127decc1e 100644 --- a//batch/latest/userguide/mnp-ce.md +++ b//batch/latest/userguide/mnp-ce.md @@ -15 +15 @@ There are several things to consider when configuring compute environments to ru - * AWS Batch multi-node parallel jobs use the Amazon ECS `awsvpc` network mode, which gives your multi-node parallel job containers the same networking properties as Amazon EC2 instances. Each multi-node parallel job container gets its own elastic network interface, a primary private IP address, and an internal DNS hostname. The network interface is created in the same VPC subnet as its host compute resource. Any security groups that are applied to your compute resources are also applied to it. For more information, see [Task Networking with the awsvpc Network Mode](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html) in the _Amazon Elastic Container Service Developer Guide_. + * AWS Batch multi-node parallel jobs use the Amazon ECS `awsvpc` network mode, which gives your multi-node parallel job containers the same networking properties as Amazon EC2 instances. Each multi-node parallel job container gets its own elastic network interface, a primary private IP address, and an internal DNS hostname. The network interface is created in the same VPC subnet as its host compute resource. @@ -17 +17 @@ There are several things to consider when configuring compute environments to ru - * Your compute environment might have no more than five security groups associated with it. + * Your compute environment might have no more than five security groups associated with it. The elastic network interfaces that are created and attached to an MNP task will use the security groups specified in your compute environment, If you don't specify a security group, the default security group for the VPC is used.