AWS AmazonECS documentation change
Summary
Significant restructuring of service update documentation including removal of detailed security group/load balancer warnings, added prerequisites/procedure sections, and AWS CLI examples
Security assessment
While removed content included security-related notes about manual security group updates, this appears to be documentation reorganization rather than addressing a specific vulnerability. No new security features or vulnerabilities are explicitly mentioned in the changes.
Diff
diff --git a/AmazonECS/latest/developerguide/update-service-console-v2.md b/AmazonECS/latest/developerguide/update-service-console-v2.md index 355a18b05..4d1e0a0a4 100644 --- a//AmazonECS/latest/developerguide/update-service-console-v2.md +++ b//AmazonECS/latest/developerguide/update-service-console-v2.md @@ -5 +5 @@ -ProcedureNext steps +PrerequisitesProcedureNext steps @@ -7 +7 @@ ProcedureNext steps -# Updating an Amazon ECS service using the console +# Updating an Amazon ECS service @@ -9 +9 @@ ProcedureNext steps -You can update the task definition, desired task count, capacity provider strategy, platform version, and deployment configuration; or any combination of these.The current service configuration is pre-populated. +After you create a service, there are times when you might need to update the service parameters, for example the number of tasks. @@ -11,64 +11 @@ You can update the task definition, desired task count, capacity provider strate -For information about how to update the blue/green deployment configuration, see [Updating an Amazon ECS blue/green deployment using the console](./update-blue-green-deployment-v2.html). - -Consider the following when you use the console: - -If you want to temporarily stop your service, set **Desired tasks** to 0\. Then, when you are ready to start the service, update the service with the original **Desired tasks** count. - -Consider the following when you use the console: - - * You must use the AWS Command Line Interface to update a service that uses any of the following parameters: - - * Blue/green deployments - - * Service Discovery – You can only view your Service Discovery configuration. - - * Tracking policy with a custom metric - - * Update Service – You cannot update the `awsvpc` network configuration and the health check grace period. - -For information about how to update a service using the AWS CLI, see [update-service](https://docs.aws.amazon.com/cli/latest/reference/ecs/update-service.html) in the _AWS Command Line Interface Reference_. - - * If you are changing the ports used by containers in a task definition, you might need to update the security groups for the container instances to work with the updated ports. - - * Amazon ECS does not automatically update the security groups associated with Elastic Load Balancing load balancers or Amazon ECS container instances. - - * If your service uses a load balancer, the load balancer configuration defined for your service when it was created cannot be changed using the console. You can instead use the AWS CLI or SDK to modify the load balancer configuration. For information about how to modify the configuration, see [UpdateService](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateService.html) in the _Amazon Elastic Container Service API Reference_. - - * If you update the task definition for the service, the container name and container port that are specified in the load balancer configuration must remain in the task definition. - - - - -You can update an existing service to change some of the service configuration parameters, such as the number of tasks that are maintained by a service, which task definition is used by the tasks, or if your tasks are using the Fargate launch type, you can change the platform version your service uses. A service using a Linux platform version cannot be updated to use a Windows platform version and vice versa. If you have an application that needs more capacity, you can scale up your service. If you have unused capacity to scale down, you can reduce the number of desired tasks in your service and free up resources. - -The container image pull behavior differs for the launch types. For more information, see one of the following: - - * [Fargate launch type for Amazon ECS](./launch-type-fargate.html) - - * [EC2 launch type for Amazon ECS](./launch-type-ec2.html) - - * [External (Amazon ECS Anywhere) launch type for Amazon ECS](./launch-type-external.html) - - - - -The service scheduler uses the minimum healthy percent and maximum percent parameters (in the deployment configuration for the service) to determine the deployment strategy. - -If a service is using the rolling update (`ECS`) deployment type, the **minimum healthy percent** represents a lower limit on the number of tasks in a service that must remain in the `RUNNING` state during a deployment, as a percentage of the desired number of tasks (rounded up to the nearest integer). The parameter also applies while any container instances are in the `DRAINING` state if the service contains tasks using the EC2 launch type. Use this parameter to deploy without using additional cluster capacity. For example, if your service has a desired number of four tasks and a minimum healthy percent of 50 percent, the scheduler may stop two existing tasks to free up cluster capacity before starting two new tasks. Tasks for services that do not use a load balancer are considered healthy if they are in the `RUNNING` state. Tasks for services that do use a load balancer are considered healthy if they are in the `RUNNING` state and they are reported as healthy by the load balancer. The default value for minimum healthy percent is 100 percent. - -If a service is using the rolling update (`ECS`) deployment type, the **maximum percent** parameter represents an upper limit on the number of tasks in a service that are allowed in the `PENDING`, `RUNNING`, or `STOPPING` state during a deployment, as a percentage of the desired number of tasks (rounded down to the nearest integer). The parameter also applies while any container instances are in the `DRAINING` state if the service contains tasks using the EC2 launch type. Use this parameter to define the deployment batch size. For example, if your service has a desired number of four tasks and a maximum percent value of 200 percent, the scheduler may start four new tasks before stopping the four older tasks. That is provided that the cluster resources required to do this are available. The default value for the maximum percent is 200 percent. - -When the service scheduler replaces a task during an update, the service first removes the task from the load balancer (if used) and waits for the connections to drain. Then, the equivalent of **docker stop** is issued to the containers running in the task. This results in a `SIGTERM` signal and a 30-second timeout, after which `SIGKILL` is sent and the containers are forcibly stopped. If the container handles the `SIGTERM` signal gracefully and exits within 30 seconds from receiving it, no `SIGKILL` signal is sent. The service scheduler starts and stops tasks as defined by your minimum healthy percent and maximum percent settings. - -The service scheduler also replaces tasks determined to be unhealthy after a container health check or a load balancer target group health check fails. This replacement depends on the `maximumPercent` and `desiredCount` service definition parameters. If a task is marked unhealthy, the service scheduler will first start a replacement task. Then, the following happens. - - * If the replacement task has a health status of `HEALTHY`, the service scheduler stops the unhealthy task - - * If the replacement task has a health status of `UNHEALTHY`, the scheduler will stop either the unhealthy replacement task or the existing unhealthy task to get the total task count to equal `desiredCount`. - - - - -If the `maximumPercent` parameter limits the scheduler from starting a replacement task first, the scheduler will stop an unhealthy task one at a time at random to free up capacity, and then start a replacement task. The start and stop process continues until all unhealthy tasks are replaced with healthy tasks. Once all unhealthy tasks have been replaced and only healthy tasks are running, if the total task count exceeds the `desiredCount`, healthy tasks are stopped at random until the total task count equals `desiredCount`. For more information about `maximumPercent` and `desiredCount`, see [Service definition parameters](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service_definition_parameters.html). - -###### Important +When you update a service that uses Amazon ECS circuit breaker, Amazon ECS creates a service deployment and a service revision. These resources allow you to view detailed information about the service history. For more information, see [View service history using Amazon ECS service deployments](./service-deployment.html). @@ -76 +13 @@ If the `maximumPercent` parameter limits the scheduler from starting a replaceme -If you are changing the ports used by containers in a task definition, you may need to update the security groups for the container instances to work with the updated ports. +## Prerequisites @@ -78 +15 @@ If you are changing the ports used by containers in a task definition, you may n -If you update the task definition for the service, the container name and container port that were specified when the service was created must remain in the task definition. +Before updating a service, verify which service parameters can be changed for your deployment type. For a complete list of changeable parameters, see [Update Amazon ECS service parameters](./update-service-parameters.html). @@ -80 +17 @@ If you update the task definition for the service, the container name and contai -Amazon ECS does not automatically update the security groups associated with Elastic Load Balancing load balancers or Amazon ECS container instances. +## Procedure @@ -82 +19 @@ Amazon ECS does not automatically update the security groups associated with Ela -When you update a service that uses Amazon ECS circuit breaker, Amazon ECS creates a service deployment and a service revision. These resources allow you to view detailed information about the service history. For more information, see [View service history using Amazon ECS service deployments](./service-deployment.html). +Console @@ -84 +20,0 @@ When you update a service that uses Amazon ECS circuit breaker, Amazon ECS creat -## Procedure @@ -174 +110 @@ Step scaling | - * If your service runs s network client application that only needs to connect to other services in the namespace, choose **Client side only**. + * If your service runs a network client application that only needs to connect to other services in the namespace, choose **Client side only**. @@ -213,0 +150,17 @@ Amazon EBS | +AWS CLI + + + * Run `update-service`. For information about running the command, see [update-service](https://docs.aws.amazon.com/cli/latest/reference/ecs/update-service.html) in the AWS Command Line Interface Reference. + +The following `update-service` example updates the desired task count of the service `my-http-service` to 2. + +Replace the `user-input` with your values. + + aws ecs update-service \ + --cluster MyCluster \ + --service my-http-service \ + --desired-count 2 + + + + @@ -224 +177 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Creating a service +Update Amazon ECS service parameters