AWS AmazonECS documentation change
Summary
Updated documentation for AmazonECSInfrastructureRolePolicyForVolumes to include ec2:DescribeInstances permission
Security assessment
Clarifies the purpose of a new IAM permission added to prevent device conflicts. While related to security policies, it addresses operational reliability rather than patching a security vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/security-iam-awsmanpol.md b/AmazonECS/latest/developerguide/security-iam-awsmanpol.md index 4e2b0ab51..2d725f5b6 100644 --- a//AmazonECS/latest/developerguide/security-iam-awsmanpol.md +++ b//AmazonECS/latest/developerguide/security-iam-awsmanpol.md @@ -27 +27 @@ You can attach the `AmazonECSInfrastructureRolePolicyForVolumes` managed policy -The policy grants the permissions that are needed by Amazon ECS to make AWS API calls on your behalf. You can attach this policy to the IAM role that you provide with your volume configuration when launching Amazon ECS tasks and services. The role enables Amazon ECS to manage volumes attached to your tasks. For more information, see [Amazon ECS infrastructure IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html). +The policy grants the permissions that are needed by Amazon ECS to make AWS API calls on your behalf. You can attach this policy to the IAM role that you provide with your volume configuration when you launch Amazon ECS tasks and services. The role allows Amazon ECS to manage volumes attached to your tasks. For more information, see [Amazon ECS infrastructure IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html). @@ -119,0 +120 @@ Change | Description | Date +Add permissions to [AmazonECSInfrastructureRolePolicyForVolumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonECSInfrastructureRolePolicyForVolumes) | The `AmazonECSInfrastructureRolePolicyForVolumes` policy has been updated to add the `ec2:DescribeInstances` permission. The permission helps prevent device name collision for Amazon EBS volumes that are attached to Amazon ECS tasks that run on the same container instance. | June 2, 2025