AWS AmazonECS medium security documentation change
Summary
Clarified when Amazon ECR permissions are required in task IAM roles vs task execution roles. Added guidance about separating permissions for application code interacting with ECR APIs vs basic image pulling.
Security assessment
The change addresses security best practices by emphasizing the principle of least privilege. It prevents over-permissioning by distinguishing between task roles (for application code needing ECR access) and task execution roles (for basic image pulling). Incorrect permission assignments could lead to excessive privileges if developers mistakenly add ECR permissions to task roles when only execution roles require them.
Diff
diff --git a/AmazonECS/latest/developerguide/task-iam-roles.md b/AmazonECS/latest/developerguide/task-iam-roles.md index f3c34d3b5..9c89ac7f4 100644 --- a//AmazonECS/latest/developerguide/task-iam-roles.md +++ b//AmazonECS/latest/developerguide/task-iam-roles.md @@ -231 +231 @@ Use Windows EC2 instances | Amazon EC2 Windows instance additional configuratio -The following permissions are require when you want to use an image in a private repository. You should add the following permissions to a task IAM role and include the task IAM role in your task definition. For more information, see [Adding and Removing IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the _IAM User Guide_. +The following permissions are required when your application code needs to interact with Amazon ECR repositories directly. Note that for basic implementation where you only need to pull images from Amazon ECR, these permissions are not required at the task IAM role level. Instead, the Amazon ECS task execution role should have these permissions. For more information about the task execution role, see [Amazon ECS task execution IAM role](./task_execution_IAM_role.html). @@ -233 +233,3 @@ The following permissions are require when you want to use an image in a private -Use the following policy for your task IAM role to add the required Amazon ECR permissions. +If your application code running in the container needs to interact with Amazon ECR APIs directly, you should add the following permissions to a task IAM role and include the task IAM role in your task definition. For more information, see [Adding and Removing IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the _IAM User Guide_. + +Use the following policy for your task IAM role to add the required Amazon ECR permissions for container applications that need to interact with Amazon ECR directly: