AWS guardduty medium security documentation change
Summary
Expanded troubleshooting guidance for GuardDuty container image pull failures, including permissions, network connectivity, security group checks, and added references to runbooks/logs. Removed explicit ECR permission list in favor of linked documentation.
Security assessment
The change addresses scenarios where GuardDuty cannot pull its security monitoring container, which directly impacts threat detection capabilities. The documentation emphasizes proper security configurations (permissions, network rules) to ensure security monitoring functions correctly. Failure to resolve these issues would leave workloads unprotected.
Diff
diff --git a/guardduty/latest/ug/gdu-assess-coverage-ecs.md b/guardduty/latest/ug/gdu-assess-coverage-ecs.md index e3ae59e31..24101edd1 100644 --- a//guardduty/latest/ug/gdu-assess-coverage-ecs.md +++ b//guardduty/latest/ug/gdu-assess-coverage-ecs.md @@ -199 +199 @@ ExitCode: `EXIT_CODE` with reason: '`EXIT_CODE`' for tasks in `TaskDefinition - -Agent exited: Reason: `CannotPullContainerError`: pull image manifest has been retried... | The task execution role must have the following Amazon Elastic Container Registry (Amazon ECR) permissions: +Agent exited: Reason: `CannotPullContainerError`: pull image manifest has been retried... | In this scenario, GuardDuty is potentially unable to pull the sidecar container image. Your task will continue to run but GuardDuty can't detect potential threats. Perform the following troubleshooting steps one at a time to check if it helps resolving the coverage issue: @@ -200,0 +201,5 @@ Agent exited: Reason: `CannotPullContainerError`: pull image manifest has been r + * **Permissions:** Ensure your task execution role has the required ECR permissions listed in [Permissions requirements](./prereq-runtime-monitoring-ecs-support.html#ecs-runtime-permissions-requirements). + * **Network connectivity:** Verify that your Fargate tasks can reach ECR either through public internet access or properly configured VPC endpoints as described in [Network connectivity requirements](./prereq-runtime-monitoring-ecs-support.html#ecs-runtime-network-requirements). + * **Security group configuration:** Check that your security group allows outbound access to the S3 managed prefix list on port 443 as explained in [Security group configuration](./prereq-runtime-monitoring-ecs-support.html#ecs-runtime-security-group-requirements). + * Run the [AWSSupport-TroubleshootECSTaskFailedToStart](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-troubleshootecstaskfailedtostart.html) runbook in your cluster's Region to identify specific issues. + * View tasks logs for error messages. For information about how to do this, see [Viewing Amazon ECS container agent logs](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/logs.html) in the _Amazon Elastic Container Service Developer Guide_. For common errors and troubleshooting, see [Amazon ECS troubleshooting](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/troubleshooting.html) in the _Amazon Elastic Container Service Developer Guide_. @@ -202,8 +207 @@ Agent exited: Reason: `CannotPullContainerError`: pull image manifest has been r - ... - "ecr:GetAuthorizationToken", - "ecr:BatchCheckLayerAvailability", - "ecr:GetDownloadUrlForLayer", - "ecr:BatchGetImage", - ... - -For more information, see [Provide ECR permissions and subnet details](./prereq-runtime-monitoring-ecs-support.html#before-enable-runtime-monitoring-ecs). After you add the Amazon ECR permissions, you must restart the task. If the issue persists, see [My AWS Step Functions workflow is failing unexpectedly](./troubleshooting-guardduty-runtime-monitoring.html#runtime-ecs-step-function-failure). +These three components (permissions, network connectivity, and security group configuration) are independent but all necessary for successfully downloading the GuardDuty container image from Amazon ECR. If the issue persists, see [My AWS Step Functions workflow is failing unexpectedly](./troubleshooting-guardduty-runtime-monitoring.html#runtime-ecs-step-function-failure). @@ -213,2 +211,2 @@ Unsupported CPU architecture '`TYPE`' for task(s) in `TaskDefinition - '`TASK_DE -`TaskExecutionRole` missing from `TaskDefinition - '`TASK_DEFINITION`'` | The ECS task execution role is missing. For information about providing task execution role and required permissions, see [Provide ECR permissions and subnet details](./prereq-runtime-monitoring-ecs-support.html#before-enable-runtime-monitoring-ecs). -Missing network configuration '``CONFIGURATION_DETAILS``' for task(s) in `TaskDefinition - '`TASK_DEFINITION`'` | Network configuration issues may show up because of missing VPC configuration, or missing or empty subnets. Validate that your network configuration is correct. For more information, see [Provide ECR permissions and subnet details](./prereq-runtime-monitoring-ecs-support.html#before-enable-runtime-monitoring-ecs). For more information, see [Amazon ECS task definition parameters](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) in the _Amazon Elastic Container Service Developer Guide_. +`TaskExecutionRole` missing from `TaskDefinition - '`TASK_DEFINITION`'` | The ECS task execution role is missing. For information about providing task execution role and required permissions, see [Prerequisites for container image access](./prereq-runtime-monitoring-ecs-support.html#before-enable-runtime-monitoring-ecs). +Missing network configuration '``CONFIGURATION_DETAILS``' for task(s) in `TaskDefinition - '`TASK_DEFINITION`'` | Network configuration issues may show up because of missing VPC configuration, or missing or empty subnets. Validate that your network configuration is correct. For more information, see [Prerequisites for container image access](./prereq-runtime-monitoring-ecs-support.html#before-enable-runtime-monitoring-ecs). For more information, see [Amazon ECS task definition parameters](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) in the _Amazon Elastic Container Service Developer Guide_.