AWS AWSCloudFormation documentation change
Summary
Expanded documentation for KMS key usage in Fargate ephemeral storage and ECS-managed storage encryption
Security assessment
Clarifies encryption practices for data at rest using KMS keys, improving guidance for secure storage configuration. No evidence of addressing a specific vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-managedstorageconfiguration.md b/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-managedstorageconfiguration.md index 98c9f713a..4a99f0fb9 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-managedstorageconfiguration.md +++ b//AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-managedstorageconfiguration.md @@ -34 +34,3 @@ To declare this entity in your AWS CloudFormation template, use the following sy -Specify the AWS Key Management Service key ID for the Fargate ephemeral storage. +Specify the AWS Key Management Service key ID for Fargate ephemeral storage. + +When you specify a `fargateEphemeralStorageKmsKeyId`, AWS Fargate uses the key to encrypt data at rest in ephemeral storage. For more information about Fargate ephemeral storage encryption, see [Customer managed keys for AWS Fargate ephemeral storage for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-storage-encryption.html) in the _Amazon Elastic Container Service Developer Guide_. @@ -47 +49,3 @@ _Required_ : No -Specify a AWS Key Management Service key ID to encrypt the managed storage. +Specify a AWS Key Management Service key ID to encrypt Amazon ECS managed storage. + +When you specify a `kmsKeyId`, Amazon ECS uses the key to encrypt data volumes managed by Amazon ECS that are attached to tasks in the cluster. The following data volumes are managed by Amazon ECS: Amazon EBS. For more information about encryption of Amazon EBS volumes attached to Amazon ECS tasks, see [Encrypt data stored in Amazon EBS volumes for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-kms-encryption.html) in the _Amazon Elastic Container Service Developer Guide_.