AWS AmazonECS documentation change
Summary
Updated task event documentation with new example structure, added security-related containers (aws-guardduty-agent and aws-otel-collector), and clarified timestamp formats
Security assessment
The change adds documentation about security monitoring components (AWS GuardDuty agent and OpenTelemetry collector) in task event examples, but does not address a specific vulnerability. The inclusion of security agent configurations demonstrates security feature usage rather than patching a security issue.
Diff
diff --git a/AmazonECS/latest/developerguide/ecs_task_events.md b/AmazonECS/latest/developerguide/ecs_task_events.md index 648c74a78..0a1f203cd 100644 --- a//AmazonECS/latest/developerguide/ecs_task_events.md +++ b//AmazonECS/latest/developerguide/ecs_task_events.md @@ -46 +46 @@ When a task is using the `FARGATE_SPOT` capacity provider and is stopped due to -Task state change events are delivered in the following format. The `detail` section below resembles the [Task](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Task.html) object that is returned from a [DescribeTasks](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html) API operation in the _Amazon Elastic Container Service API Reference_. If your containers are using an image hosted with Amazon ECR, the `imageDigest` field is returned. +Task state change events are delivered in the following format. Note the following about the fields: @@ -48 +48 @@ Task state change events are delivered in the following format. The `detail` sec -###### Note + * The health status of the event is not available in the task state change event. If you need the task health status, you can run [describe-tasks](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html). @@ -50 +50 @@ Task state change events are delivered in the following format. The `detail` sec -The values for the `createdAt`, `connectivityAt`, `pullStartedAt`, `startedAt`, `pullStoppedAt`, and `updatedAt` fields are UNIX timestamps in the response of a `DescribeTasks` action whereas in the task state change event they are ISO string timestamps. + * When your containers use an image hosted with Amazon ECR, the `imageDigest` field is returned. @@ -52 +52 @@ The values for the `createdAt`, `connectivityAt`, `pullStartedAt`, `startedAt`, -For more information about EventBridge parameters, see [AWS service event metadata](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-events-structure.html) in the _Amazon EventBridge User Guide_. + * The values for the `createdAt`, `connectivityAt`, `pullStartedAt`, `startedAt`, `pullStoppedAt`, and `updatedAt` fields are ISO string timestamps. @@ -54 +54,10 @@ For more information about EventBridge parameters, see [AWS service event metada -For information about how to configure configure an Amazon EventBridge event rule that only captures task events where the task has stopped running because one of its essential containers has terminated, see [Sending Amazon Simple Notification Service alerts for Amazon ECS task stopped events](./ecs_cwet2.html) + * The `detail-type` value is "ECS Task State Change". + + * When the event is generated for a stopped task, the `stoppedReason` and `stoppedCode` fields provide additional information about why the task stopped (for example, "User initiated"). + + + + +For more information about EventBridge parameters, see [AWS service event metadata](https://docs.aws.amazon.com/eventbridge/latest/ref/events-structure.html) in the _Amazon EventBridge Events Reference_. + +For information about how to configure an Amazon EventBridge event rule that only captures task events where the task has stopped running because one of its essential containers has terminated, see [Sending Amazon Simple Notification Service alerts for Amazon ECS task stopped events](./ecs_cwet2.html) @@ -59 +68 @@ For information about how to configure configure an Amazon EventBridge event rul - "id": "3317b2af-7005-947d-b652-f55e762e571a", + "id": "105f6bb1-4da6-c630-4965-35383018cbca", @@ -62,3 +71,3 @@ For information about how to configure configure an Amazon EventBridge event rul - "account": "111122223333", - "time": "2020-01-23T17:57:58Z", - "region": "us-west-2", + "account": "123456789012", + "time": "2025-05-06T11:02:34Z", + "region": "us-east-1", @@ -66 +75 @@ For information about how to configure configure an Amazon EventBridge event rul - "arn:aws:ecs:us-west-2:111122223333:task/FargateCluster/c13b4cb40f1f4fe4a2971f76ae5a47ad" + "arn:aws:ecs:us-east-1:123456789012:task/example-cluster/a1173316d40a45dea9" @@ -71 +80 @@ For information about how to configure configure an Amazon EventBridge event rul - "id": "1789bcae-ddfb-4d10-8ebe-8ac87ddba5b8", + "id": "fe3a9a46-6a47-40ee-afd9-7952ae90a75a", @@ -77 +86 @@ For information about how to configure configure an Amazon EventBridge event rul - "value": "subnet-abcd1234" + "value": "subnet-0d0eab1bb38d5ca64" @@ -81 +90 @@ For information about how to configure configure an Amazon EventBridge event rul - "value": "eni-abcd1234" + "value": "eni-0103a2f01bad57d71" @@ -85 +94,5 @@ For information about how to configure configure an Amazon EventBridge event rul - "value": "0a:98:eb:a7:29:ba" + "value": "0e:50:d1:c1:77:81" + }, + { + "name": "privateDnsName", + "value": "ip-10-0-1-163.ec2.internal" @@ -89 +102 @@ For information about how to configure configure an Amazon EventBridge event rul - "value": "10.0.0.139" + "value": "10.0.1.163" @@ -94,2 +107,11 @@ For information about how to configure configure an Amazon EventBridge event rul - "availabilityZone": "us-west-2c", - "clusterArn": "arn:aws:ecs:us-west-2:111122223333:cluster/FargateCluster", + "attributes": [ + { + "name": "ecs.cpu-architecture", + "value": "x86_64" + } + ], + "availabilityZone": "us-east-1b", + "capacityProviderName": "FARGATE", + "clusterArn": "arn:aws:ecs:us-east-1:123456789012:cluster/example-cluster", + "connectivity": "CONNECTED", + "connectivityAt": "2025-05-06T11:02:17.19Z", @@ -98 +120 @@ For information about how to configure configure an Amazon EventBridge event rul - "containerArn": "arn:aws:ecs:us-west-2:111122223333:container/cf159fd6-3e3f-4a9e-84f9-66cbe726af01", + "containerArn": "arn:aws:ecs:us-east-1:123456789012:container/example-cluster/a1173316d40a45dea9/a0a99b87-baa8-4bf6-b9f1-a9a95917a635", @@ -100,5 +122,5 @@ For information about how to configure configure an Amazon EventBridge event rul - "name": "FargateApp", - "image": "111122223333.dkr.ecr.us-west-2.amazonaws.com/hello-repository:latest", - "imageDigest": "sha256:74b2c688c700ec95a93e478cdb959737c148df3fbf5ea706abe0318726e885e6", - "runtimeId": "ad64cbc71c7fb31c55507ec24c9f77947132b03d48d9961115cf24f3b7307e1e", - "taskArn": "arn:aws:ecs:us-west-2:111122223333:task/FargateCluster/c13b4cb40f1f4fe4a2971f76ae5a47ad", + "name": "web", + "image": "nginx", + "imageDigest": "sha256:c15da6c91de8d2f436196f3a768483ad32c258ed4e1beb3d367a27ed67253e66", + "runtimeId": "a1173316d40a45dea9-0265927825", + "taskArn": "arn:aws:ecs:us-east-1:123456789012:task/example-cluster/a1173316d40a45dea9", @@ -107,2 +129,34 @@ For information about how to configure configure an Amazon EventBridge event rul - "attachmentId": "1789bcae-ddfb-4d10-8ebe-8ac87ddba5b8", - "privateIpv4Address": "10.0.0.139" + "attachmentId": "fe3a9a46-6a47-40ee-afd9-7952ae90a75a", + "privateIpv4Address": "10.0.1.163" + } + ], + "cpu": "99", + "memory": "100" + }, + { + "containerArn": "arn:aws:ecs:us-east-1:123456789012:container/example-cluster/a1173316d40a45dea9/a2010e2d-ba7c-4135-8b79-e0290ff3cd8c", + "lastStatus": "RUNNING", + "name": "aws-guardduty-agent-nm40lC", + "imageDigest": "sha256:bf9197abdf853607e5fa392b4f97ccdd6ca56dd179be3ce8849e552d96582ac8", + "runtimeId": "a1173316d40a45dea9-2098416933", + "taskArn": "arn:aws:ecs:us-east-1:123456789012:task/example-cluster/a1173316d40a45dea9", + "networkInterfaces": [ + { + "attachmentId": "fe3a9a46-6a47-40ee-afd9-7952ae90a75a", + "privateIpv4Address": "10.0.1.163" + } + ], + "cpu": "null" + }, + { + "containerArn": "arn:aws:ecs:us-east-1:123456789012:container/example-cluster/a1173316d40a45dea9/dccf0ca2-d929-471f-a5c3-98006fd4379e", + "lastStatus": "RUNNING", + "name": "aws-otel-collector", + "image": "public.ecr.aws/aws-observability/aws-otel-collector:v0.32.0", + "imageDigest": "sha256:7a1b3560655071bcacd66902c20ebe9a69470d5691fe3bd36baace7c2f3c4640", + "runtimeId": "a1173316d40a45dea9-4027662657", + "taskArn": "arn:aws:ecs:us-east-1:123456789012:task/example-cluster/a1173316d40a45dea9", + "networkInterfaces": [ + { + "attachmentId": "fe3a9a46-6a47-40ee-afd9-7952ae90a75a", + "privateIpv4Address": "10.0.1.163" @@ -114,2 +167,0 @@ For information about how to configure configure an Amazon EventBridge event rul - "createdAt": "2020-01-23T17:57:34.402Z", - "launchType": "FARGATE", @@ -117 +169 @@ For information about how to configure configure an Amazon EventBridge event rul - "memory": "512", + "createdAt": "2025-05-06T11:02:13.877Z", @@ -119 +171,6 @@ For information about how to configure configure an Amazon EventBridge event rul - "group": "family:sample-fargate", + "enableExecuteCommand": false, + "ephemeralStorage": { + "sizeInGiB": 20 + }, + "group": "family:webserver", + "launchType": "FARGATE", @@ -120,0 +178 @@ For information about how to configure configure an Amazon EventBridge event rul + "memory": "512", @@ -124 +182,30 @@ For information about how to configure configure an Amazon EventBridge event rul - "name": "FargateApp" + "name": "web" + }, + { + "environment": [ + { + "name": "CLUSTER_NAME", + "value": "example-cluster" + }, + { + "name": "REGION", + "value": "us-east-1" + }, + { + "name": "HOST_PROC", + "value": "/host_proc" + }, + { + "name": "AGENT_RUNTIME_ENVIRONMENT", + "value": "ecsfargate" + }, + { + "name": "STAGE", + "value": "prod" + } + ], + "memory": 128, + "name": "aws-guardduty-agent-nm40lC" + }, + { + "name": "aws-otel-collector" @@ -128,10 +215,8 @@ For information about how to configure configure an Amazon EventBridge event rul - "connectivity": "CONNECTED", - "connectivityAt": "2020-01-23T17:57:38.453Z", - "pullStartedAt": "2020-01-23T17:57:52.103Z", - "startedAt": "2020-01-23T17:57:58.103Z", - "pullStoppedAt": "2020-01-23T17:57:55.103Z", - "updatedAt": "2020-01-23T17:57:58.103Z", - "taskArn": "arn:aws:ecs:us-west-2:111122223333:task/FargateCluster/c13b4cb40f1f4fe4a2971f76ae5a47ad", - "taskDefinitionArn": "arn:aws:ecs:us-west-2:111122223333:task-definition/sample-fargate:1", - "version": 4, - "platformVersion": "1.3.0" + "platformVersion": "1.4.0", + "pullStartedAt": "2025-05-06T11:02:24.162Z", + "pullStoppedAt": "2025-05-06T11:02:33.493Z", + "startedAt": "2025-05-06T11:02:34.325Z", + "taskArn": "arn:aws:ecs:us-east-1:123456789012:task/example-cluster/a1173316d40a45dea9", + "taskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/webserver:5", + "updatedAt": "2025-05-06T11:02:34.325Z", + "version": 3