AWS AmazonECS medium security documentation change

Service: AmazonECS · 2025-06-04 · Security-related medium

File: AmazonECS/latest/developerguide/vpc-endpoints.md

Summary

Added documentation about ECS agent endpoint naming patterns and DiscoverPollEndpoint API requirements

Security assessment

Highlights a potential security risk where misconfigured VPC endpoints could cause traffic to use public internet routes. The documentation explicitly warns about security implications of endpoint configuration, making it security-related.

Diff

diff --git a/AmazonECS/latest/developerguide/vpc-endpoints.md b/AmazonECS/latest/developerguide/vpc-endpoints.md
index 1dcfe203f..a38a91bb4 100644
--- a//AmazonECS/latest/developerguide/vpc-endpoints.md
+++ b//AmazonECS/latest/developerguide/vpc-endpoints.md
@@ -110,0 +111,26 @@ When you create endpoints, Amazon ECS also creates a private DNS name for the en
+### Understanding ECS endpoint naming patterns
+
+It's important to understand that the ECS agent may make requests to endpoints with numbered suffixes, such as:
+
+  * `ecs-a-1.region.amazonaws.com`, `ecs-a-2.region.amazonaws.com`, etc. for agent endpoints
+
+  * `ecs-t-1.region.amazonaws.com`, `ecs-t-2.region.amazonaws.com`, etc. for telemetry endpoints
+
+
+
+
+This behavior occurs because the ECS agent uses the [DiscoverPollEndpoint](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DiscoverPollEndpoint.html) API to dynamically determine which specific endpoint to connect to. If your VPC endpoints don't properly handle these numbered endpoint variations, the agent will fall back to using public endpoints, even if you've configured VPC endpoints for the base names.
+
+#### The role of DiscoverPollEndpoint API
+
+The [DiscoverPollEndpoint](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DiscoverPollEndpoint.html) API is used by the ECS agent to discover the appropriate endpoint to poll for tasks. When the agent calls this API, it receives a specific endpoint URL that may include a numbered suffix. To ensure your VPC endpoints work correctly, your network configuration must allow the agent to:
+
+  1. Access the DiscoverPollEndpoint API
+
+  2. Connect to the returned endpoint URLs, including those with numbered suffixes
+
+
+
+
+If you're troubleshooting VPC endpoint connectivity issues, verify that your agent can reach both the base endpoints and any numbered variations that might be returned by the DiscoverPollEndpoint API.
+