AWS AmazonECS documentation change
Summary
Enhanced documentation for private registry authentication, clarifying usage of Secrets Manager and KMS for credential storage. Added explicit permissions requirements and references to related documentation.
Security assessment
The changes provide clearer security documentation about handling private registry credentials using AWS Secrets Manager and KMS encryption. While this improves security practices documentation, there's no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/AmazonECS/latest/developerguide/private-auth.md b/AmazonECS/latest/developerguide/private-auth.md index 8360d7261..2e87a3e1d 100644 --- a//AmazonECS/latest/developerguide/private-auth.md +++ b//AmazonECS/latest/developerguide/private-auth.md @@ -54 +54 @@ Another method of enabling private registry authentication uses Amazon ECS conta -To provide access to the secrets that you create, add the following permissions as an inline policy to the task execution role. For more information, see [Adding and Removing IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html). +Private registry authentication allows your Amazon ECS tasks to pull container images from private registries outside of AWS (such as Docker Hub, Quay.io, or your own private registry) that require authentication credentials. This feature uses Secrets Manager to securely store your registry credentials, which are then referenced in your task definition using the `repositoryCredentials` parameter. @@ -56 +56 @@ To provide access to the secrets that you create, add the following permissions - * `secretsmanager:GetSecretValue` +For more information about configuring private registry authentication, see [Using non-AWS container images in Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html). @@ -58 +58,5 @@ To provide access to the secrets that you create, add the following permissions - * `kms:Decrypt`—Required only if your key uses a custom KMS key and not the default key. The Amazon Resource Name (ARN) for your custom key must be added as a resource. +To provide access to the secrets that contain your private registry credentials, add the following permissions as an inline policy to the task execution role. For more information, see [Adding and Removing IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html). + + * `secretsmanager:GetSecretValue`—Required to retrieve the private registry credentials from Secrets Manager. + + * `kms:Decrypt`—Required only if your secret uses a custom KMS key and not the default key. The Amazon Resource Name (ARN) for your custom key must be added as a resource.