AWS AmazonECS medium security documentation change

Service: AmazonECS · 2025-06-13 · Security-related medium

File: AmazonECS/latest/developerguide/instance_IAM_role.md

Summary

Added documentation about IAM permissions required for awsvpcTrunking account setting and user data configuration

Security assessment

Added IAM policy requiring ecs:PutAccountSetting permission and user data script to enable trunking. Proper IAM permissions are critical for security to prevent privilege escalation. The change explicitly documents required security controls for network configuration.

Diff

diff --git a/AmazonECS/latest/developerguide/instance_IAM_role.md b/AmazonECS/latest/developerguide/instance_IAM_role.md
index a97a984f8..ad334d0fb 100644
--- a//AmazonECS/latest/developerguide/instance_IAM_role.md
+++ b//AmazonECS/latest/developerguide/instance_IAM_role.md
@@ -5 +5 @@
-Create the container instance roleAmazon ECR permissions Amazon S3 read-only access Monitoring container instances permissions
+Create the container instance roleAmazon ECR permissions Permissions required for setting the awsvpcTrunking account setting Amazon S3 read-only access Monitoring container instances permissions
@@ -17,2 +16,0 @@ Amazon ECS provides the `AmazonEC2ContainerServiceforEC2Role` managed IAM policy
-Amazon ECS supports launching container instances with increased ENI density using supported Amazon EC2 instance types. When you use this feature, we recommend that you create 2 container instance roles. Enable the `awsvpcTrunking` account setting for one role and use that role for tasks that require ENI trunking. For information about the `awsvpcTrunking` account setting, see [Access Amazon ECS features with account settings](./ecs-account-settings.html).
-
@@ -143,0 +142,32 @@ If you use the `AmazonEC2ContainerServiceforEC2Role` managed policy for your con
+##  Permissions required for setting the awsvpcTrunking account setting
+
+Amazon ECS supports launching container instances with increased ENI density using supported Amazon EC2 instance types. When you use this feature, we recommend that you create 2 container instance roles. Enable the `awsvpcTrunking` account setting for one role and use that role for tasks that require ENI trunking. For information about the `awsvpcTrunking` account setting, see [Access Amazon ECS features with account settings](./ecs-account-settings.html).
+
+The container instance role that you use with your container instances must have the following IAM policy permissions for setting the account setting 
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "ecs:ListAccountSettings", 
+                    "ecs:ListAttributes", 
+                    "ecs:PutAccountSetting" 
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+
+In order to use the conatiner instance role, add the following to instance user data:
+    
+    
+    #!/bin/bash
+    aws ecs put-account-setting --name awsvpcTrunking --value enabled --region region
+    ECS_CLUSTER=MyCluster>> /etc/ecs/ecs.config
+    EOF
+
+For more information about adding user data to your EC2 instances, see [Run commands on your Linux instance at launch](https://docs.aws.amazon.com/EC2/latest/UserGuide/user-data.html) in the _Amazon EC2 User Guide_.
+