AWS AmazonECS documentation change
Summary
Updated EBS volume configuration documentation with encryption behavior clarifications, KMS key hierarchy details, and added new 'volumeInitializationRate' parameter for snapshot-based volume creation.
Security assessment
The changes explicitly clarify encryption enforcement (EBS encryption by default overrides user settings) and KMS key precedence (task-level keys override cluster/default keys), which are security-relevant configurations. However, there is no evidence of a specific security vulnerability being addressed. The updates improve documentation of existing security features like encryption and key management.
Diff
diff --git a/AmazonECS/latest/developerguide/service_definition_parameters.md b/AmazonECS/latest/developerguide/service_definition_parameters.md index a4c82dab4..f5a0a5478 100644 --- a//AmazonECS/latest/developerguide/service_definition_parameters.md +++ b//AmazonECS/latest/developerguide/service_definition_parameters.md @@ -750 +750,3 @@ Required: No -The configuration that will be used to create volumes for tasks that are managed by the service. One volume is created for each task in the service. Only volumes that are marked as `configuredAtLaunch` in the task definition can be configured by using this object. This object is required for attaching Amazon EBS data volumes to tasks that are managed by a service. For more information, see [Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-volumes.html). +The configuration that will be used to create volumes for tasks that are managed by the service. Only volumes that are marked as `configuredAtLaunch` in the task definition can be configured by using this object. + +This object is required for attaching Amazon EBS volumes to tasks that are managed by a service. For more information, see [Use Amazon EBS volumes with Amazon ECS](./ebs-volumes.html). @@ -768 +770 @@ Required: No -The volume configuration for Amazon EBS volumes that are attached to tasks that are managed by a service when a service is created or updated. +The volume configuration used for creating Amazon EBS volumes that are attached to tasks that are maintained by a service when the service is created or updated. One volume is attached per task. @@ -779 +781 @@ Valid values: `true`|`false` -Specifies whether the Amazon EBS volume that's attached to tasks managed by a service will be encrypted. If you've turned on Amazon EBS encryption by default for your account, this setting will be overridden, and the volume will be encrypted. For more information about EBS encryption by default, see [Enable Amazon EBS encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) in the _Amazon EBS User Guide_. +Specifies whether to encrypt each created Amazon EBS volume. If you've turned on Amazon EBS encryption by default for a particular AWS Region for your AWS account but set this parameter to `false`, this parameter will be overridden, and the volumes will be encrypted with the KMS key specified for encryption by default. For more information about Amazon EBS encryption by default, see [Enable Amazon EBS encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) in the _Amazon EBS User Guide_. For more information about encrypting Amazon EBS volumes attached to Amazon ECS tasks, see [Encrypt data stored in Amazon EBS volumes attached to Amazon ECS tasks](./ebs-kms-encryption.html). @@ -788 +790,3 @@ Required: No -The identifier of the AWS Key Management Service (AWS KMS) key to use for Amazon EBS encryption. If this parameter is not specified, your AWS KMS key for Amazon EBS is used. If `KmsKeyId` is specified, the encrypted state must be `true`. +The identifier of the AWS Key Management Service (AWS KMS) key to use for Amazon EBS encryption. If `kmsKeyId` is specified, the encrypted state must be `true`. + +The key specified using this parameter overrides the Amazon EBS default or any cluster-level KMS key for Amazon ECS managed storage encryption that you may have specified. For more information, see [Encrypt data stored in Amazon EBS volumes attached to Amazon ECS tasks](./ebs-kms-encryption.html). @@ -816 +820 @@ Valid values: `gp2`|`gp3`|`io1`|`io2`|`sc1`|`st1`|`standard` -The EBS volume type. For more information about volume types, see [Amazon EBS volume types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volume-types.html) in the _Amazon EBS User Guide_. The default volume type is `gp3`. +The Amazon EBS volume type. For more information about volume types, see [Amazon EBS volume types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volume-types.html) in the _Amazon EBS User Guide_. The default volume type is `gp3`. @@ -820 +824 @@ The EBS volume type. For more information about volume types, see [Amazon EBS vo -The `standard` volume type is not supported for Amazon EBS volumes configured for attachment to Fargate tasks. +The `standard` volume type is not supported for Fargate tasks. @@ -848 +852,10 @@ Required: No -The ID of the snapshot of an existing EBS volume that's used to create a new volume that's attached to the ECS task. +The ID of the snapshot of an existing Amazon EBS volume that Amazon ECS uses to create new volumes for attachment. You must specify either a `snapshotId` or a `sizeInGiB`. + +`volumeInitializationRate` + + +Type: Integer + +Required: No + +The rate, in MiB/s, at which data is fetched from a snapshot of an existing Amazon EBS volume to create new volumes for attachment. This property can be specified only if you specify a `snapshotId`. For more information about this volume initialization rate, including the range of supported rates for initialization, see [Initialize Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/initalize-volume.html) in the _Amazon EBS User Guide_. @@ -872 +885 @@ Required: No -The throughput to provision for volumes that are attached to tasks that are managed by a service. +The throughput to provision for the volumes that are attached to tasks that are maintained by a service. @@ -894 +907 @@ Required: No -The specification for tags to be applied to serivce managed Amazon EBS volumes. +The specification for tags to be applied to each Amazon EBS volume. @@ -914 +927 @@ Required: No -The metadata that you apply to volumes to help you categorize and organize them. Each tag consists of a key and an optional value, both of which you define. `AmazonECSCreated` and `AmazonECSManaged` are reserved tags that added by Amazon ECS on your behalf, so you can specify a maximum of 48 tags of your own. When a volume is deleted, the tags are deleted as well. For more information, see [Tagging Amazon ECS resources](./ecs-using-tags.html). +The metadata that you apply to volumes to help you categorize and organize them. Each tag consists of a key and an optional value, both of which you define. `AmazonECSCreated` and `AmazonECSManaged` are reserved tags that are added by Amazon ECS on your behalf, so you can specify a maximum of 48 tags of your own. When a volume is deleted, the tags are deleted as well. For more information, see [Tagging Amazon ECS resources](./ecs-using-tags.html). @@ -1093,0 +1107 @@ Amazon EC2 launch type + "volumeInitializationRate": 0, @@ -1235,0 +1250 @@ Fargate launch type + "volumeInitializationRate": 0,