AWS AmazonECS documentation change
Summary
Added Volume initialization rate configuration for snapshots and renumbered subsequent steps
Security assessment
The change introduces a performance-related parameter (Volume initialization rate) for snapshot-based EBS volumes but contains no security fixes or vulnerabilities. Existing security-related content about encryption and IAM roles was preserved through renumbering without substantive changes.
Diff
diff --git a/AmazonECS/latest/developerguide/standalone-task-create.md b/AmazonECS/latest/developerguide/standalone-task-create.md index fb891dc96..98340aa59 100644 --- a//AmazonECS/latest/developerguide/standalone-task-create.md +++ b//AmazonECS/latest/developerguide/standalone-task-create.md @@ -89,6 +89,7 @@ Amazon EBS | - 6. For **Termination policy** , deselect the checkbox if you want the volume configured for attachment to the task to be preserved after the task is terminated. By default, EBS volumes that are attached to tasks are deleted when the task is terminated. - 7. For **File system type** , choose the type of file system that will be used for data storage and retrieval on the volume. You can choose either the operating system default or a specific file system type. The default for Linux is `XFS`. For volumes created from a snapshot, you must specify the same filesystem type that the volume was using when the snapshot was created. If there is a filesystem type mismatch, the task will fail to start. - 8. For **Infrastructure role** , choose an IAM role with the necessary permissions that allow Amazon ECS to manage Amazon EBS volumes for tasks. You can attach the `AmazonECSInfrastructureRolePolicyForVolumes` managed policy to the role, or you can use the policy as a guide to create and attach an your own policy with permissions that meet your specific needs. For more information about the necessary permissions, see see [Amazon ECS infrastructure IAM role](./infrastructure_IAM_role.html). - 9. For **Encryption** , choose **Default** if you want to use the Amazon EBS encryption by default settings. If your account has [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) configured, the volume will be encrypted with the AWS Key Management Service (AWS KMS) key that's specified in the setting. If you choose **Default** and Amazon EBS default encryption isn't turned on, the volume will be unencrypted. If you choose **Custom** , you can specify an AWS KMS key of your choice for volume encryption. If you choose **None** , the volume will be unencrypted unless you have encryption by default configured, or if you create a volume from an encrypted snapshot. - 10. If you've chosen **Custom** for **Encryption** , you must specify the AWS KMS key that you want to use. For **KMS key** , choose an AWS KMS key or enter a key ARN. If you choose to encrypt your volume by using a symmetric customer managed key, make sure that you have the right permissions defined in your AWS KMS key policy. For more information, see [Data encryption for Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-volumes.html?icmpid=docs_ecs_hp-deploy#ebs-kms-encryption). - 11. (Optional) Under **Tags** , you can add tags to your Amazon EBS volume by either propagating tags from the task definition or by providing your own tags. If you want to propagate tags from the task definition, choose **Task definition** for **Propagate tags from**. If you choose **Do not propagate** , or if you don't choose a value, the tags aren't propagated. If you want to provide your own tags, choose **Add tag** and then provide the key and value for each tag you add. For more information about tagging Amazon EBS volumes, see [Tagging Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specify-ebs-config.html#ebs-volume-tagging). + 6. If you specify a **Snapshot ID** , you can specify a **Volume initialization rate (MiB/s)**. Enter a value between 100 and 300, in MiB/s, that will determine how fast data is loaded from the snapshot specified using **Snapshot ID** for volume creation. + 7. For **Termination policy** , deselect the checkbox if you want the volume configured for attachment to the task to be preserved after the task is terminated. By default, EBS volumes that are attached to tasks are deleted when the task is terminated. + 8. For **File system type** , choose the type of file system that will be used for data storage and retrieval on the volume. You can choose either the operating system default or a specific file system type. The default for Linux is `XFS`. For volumes created from a snapshot, you must specify the same filesystem type that the volume was using when the snapshot was created. If there is a filesystem type mismatch, the task will fail to start. + 9. For **Infrastructure role** , choose an IAM role with the necessary permissions that allow Amazon ECS to manage Amazon EBS volumes for tasks. You can attach the `AmazonECSInfrastructureRolePolicyForVolumes` managed policy to the role, or you can use the policy as a guide to create and attach an your own policy with permissions that meet your specific needs. For more information about the necessary permissions, see see [Amazon ECS infrastructure IAM role](./infrastructure_IAM_role.html). + 10. For **Encryption** , choose **Default** if you want to use the Amazon EBS encryption by default settings. If your account has [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) configured, the volume will be encrypted with the AWS Key Management Service (AWS KMS) key that's specified in the setting. If you choose **Default** and Amazon EBS default encryption isn't turned on, the volume will be unencrypted. If you choose **Custom** , you can specify an AWS KMS key of your choice for volume encryption. If you choose **None** , the volume will be unencrypted unless you have encryption by default configured, or if you create a volume from an encrypted snapshot. + 11. If you've chosen **Custom** for **Encryption** , you must specify the AWS KMS key that you want to use. For **KMS key** , choose an AWS KMS key or enter a key ARN. If you choose to encrypt your volume by using a symmetric customer managed key, make sure that you have the right permissions defined in your AWS KMS key policy. For more information, see [Data encryption for Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-volumes.html?icmpid=docs_ecs_hp-deploy#ebs-kms-encryption). + 12. (Optional) Under **Tags** , you can add tags to your Amazon EBS volume by either propagating tags from the task definition or by providing your own tags. If you want to propagate tags from the task definition, choose **Task definition** for **Propagate tags from**. If you choose **Do not propagate** , or if you don't choose a value, the tags aren't propagated. If you want to provide your own tags, choose **Add tag** and then provide the key and value for each tag you add. For more information about tagging Amazon EBS volumes, see [Tagging Amazon EBS volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specify-ebs-config.html#ebs-volume-tagging).