AWS AmazonECS documentation change
Summary
Added new step 6 for specifying volume initialization rate when using a snapshot, and renumbered subsequent steps. No content changes to security-related sections (encryption, IAM roles, KMS keys) other than step numbering.
Security assessment
The change introduces a performance configuration parameter (volume initialization rate) but does not modify security controls. Existing security documentation about encryption, IAM roles, and KMS keys remains unchanged except for step numbering. No evidence of addressing vulnerabilities or weaknesses.
Diff
diff --git a/AmazonECS/latest/developerguide/create-service-console-v2.md b/AmazonECS/latest/developerguide/create-service-console-v2.md index e70aa35e9..2b9132cbe 100644 --- a//AmazonECS/latest/developerguide/create-service-console-v2.md +++ b//AmazonECS/latest/developerguide/create-service-console-v2.md @@ -391,5 +391,6 @@ Amazon EBS | - 6. For **File system type** , choose the type of file system that will be used for data storage and retrieval on the volume. You can choose either the operating system default or a specific file system type. The default for Linux is `XFS`. For volumes created from a snapshot, you must specify the same filesystem type that the volume was using when the snapshot was created. If there is a filesystem type mismatch, the task will fail to start. - 7. For **Infrastructure role** , choose an IAM role with the necessary permissions that allow Amazon ECS to manage Amazon EBS volumes for tasks. You can attach the `AmazonECSInfrastructureRolePolicyForVolumes` managed policy to the role, or you can use the policy as a guide to create and attach an your own policy with permissions that meet your specific needs. For more information about the necessary permissions, see [Amazon ECS infrastructure IAM role](./infrastructure_IAM_role.html). - 8. For **Encryption** , choose **Default** if you want to use the Amazon EBS encryption by default settings. If your account has [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) configured, the volume will be encrypted with the AWS Key Management Service (AWS KMS) key that's specified in the setting. If you choose **Default** and Amazon EBS default encryption isn't turned on, the volume will be unencrypted. If you choose **Custom** , you can specify an AWS KMS key of your choice for volume encryption. If you choose **None** , the volume will be unencrypted unless you have encryption by default configured, or if you create a volume from an encrypted snapshot. - 9. If you've chosen **Custom** for **Encryption** , you must specify the AWS KMS key that you want to use. For **KMS key** , choose an AWS KMS key or enter a key ARN. If you choose to encrypt your volume by using a symmetric customer managed key, make sure that you have the right permissions defined in your AWS KMS key policy. For more information, see [Data encryption for Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-volumes.html?icmpid=docs_ecs_hp-deploy#ebs-kms-encryption). - 10. (Optional) Under **Tags** , you can add tags to your Amazon EBS volume by either propagating tags from the task definition or service, or by providing your own tags. If you want to propagate tags from the task definition, choose **Task definition** for **Propagate tags from**. If you want to propagate tags from the service, choose **Service** for **Propagate tags from**. If you choose **Do not propagate** , or if you don't choose a value, the tags aren't propagated. If you want to provide your own tags, choose **Add tag** and then provide the key and value for each tag you add. For more information about tagging Amazon EBS volumes, see [Tagging Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specify-ebs-config.html#ebs-volume-tagging). + 6. If you specify a **Snapshot ID** , you can specify a **Volume initialization rate (MiB/s)**. Enter a value between 100 and 300, in MiB/s, that will determine how fast data is loaded from the snapshot specified using **Snapshot ID** for volume creation. + 7. For **File system type** , choose the type of file system that will be used for data storage and retrieval on the volume. You can choose either the operating system default or a specific file system type. The default for Linux is `XFS`. For volumes created from a snapshot, you must specify the same filesystem type that the volume was using when the snapshot was created. If there is a filesystem type mismatch, the task will fail to start. + 8. For **Infrastructure role** , choose an IAM role with the necessary permissions that allow Amazon ECS to manage Amazon EBS volumes for tasks. You can attach the `AmazonECSInfrastructureRolePolicyForVolumes` managed policy to the role, or you can use the policy as a guide to create and attach an your own policy with permissions that meet your specific needs. For more information about the necessary permissions, see [Amazon ECS infrastructure IAM role](./infrastructure_IAM_role.html). + 9. For **Encryption** , choose **Default** if you want to use the Amazon EBS encryption by default settings. If your account has [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) configured, the volume will be encrypted with the AWS Key Management Service (AWS KMS) key that's specified in the setting. If you choose **Default** and Amazon EBS default encryption isn't turned on, the volume will be unencrypted. If you choose **Custom** , you can specify an AWS KMS key of your choice for volume encryption. If you choose **None** , the volume will be unencrypted unless you have encryption by default configured, or if you create a volume from an encrypted snapshot. + 10. If you've chosen **Custom** for **Encryption** , you must specify the AWS KMS key that you want to use. For **KMS key** , choose an AWS KMS key or enter a key ARN. If you choose to encrypt your volume by using a symmetric customer managed key, make sure that you have the right permissions defined in your AWS KMS key policy. For more information, see [Data encryption for Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-volumes.html?icmpid=docs_ecs_hp-deploy#ebs-kms-encryption). + 11. (Optional) Under **Tags** , you can add tags to your Amazon EBS volume by either propagating tags from the task definition or service, or by providing your own tags. If you want to propagate tags from the task definition, choose **Task definition** for **Propagate tags from**. If you want to propagate tags from the service, choose **Service** for **Propagate tags from**. If you choose **Do not propagate** , or if you don't choose a value, the tags aren't propagated. If you want to provide your own tags, choose **Add tag** and then provide the key and value for each tag you add. For more information about tagging Amazon EBS volumes, see [Tagging Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specify-ebs-config.html#ebs-volume-tagging).