AWS AmazonECS documentation change
Summary
Reorganized documentation structure - moved 'Understanding Amazon ECS endpoint naming patterns' section earlier and adjusted heading levels. Added note about traffic routing through public endpoints if VPC endpoints are not fully configured.
Security assessment
The changes are structural/organizational improvements to documentation flow. While the note about public endpoint traffic routing mentions security implications of misconfiguration, there's no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/AmazonECS/latest/developerguide/vpc-endpoints.md b/AmazonECS/latest/developerguide/vpc-endpoints.md index 8db4744a4..cd68e286a 100644 --- a//AmazonECS/latest/developerguide/vpc-endpoints.md +++ b//AmazonECS/latest/developerguide/vpc-endpoints.md @@ -5 +5 @@ -Considerations Creating the VPC Endpoints for Amazon ECSCreating a VPC endpoint policy for Amazon ECS +Considerations Understanding Amazon ECS endpoint naming patternsCreating the VPC Endpoints for Amazon ECSCreating a VPC endpoint policy for Amazon ECS @@ -101,11 +101 @@ Before you set up interface VPC endpoints for Amazon ECS, be aware of the follow -## Creating the VPC Endpoints for Amazon ECS - -To create the VPC endpoint for the Amazon ECS service, use the [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint) procedure in the _Amazon VPC User Guide_ to create the following endpoints. If you have existing container instances within your VPC, you should create the endpoints in the order that they're listed. If you plan on creating your container instances after your VPC endpoint is created, the order doesn't matter. - -###### Note - -If you do not configure all of the endpoints, your traffic will go over the public endpoints, not your VPC endpoint. - -When you create endpoints, Amazon ECS also creates a private DNS name for the endpoint. For example, `ecs-a.region.amazonaws.com` for ecs-agent and `ecs-t.region.amazonaws.com` for ecs-telemetry. - -### Understanding Amazon ECS endpoint naming patterns +## Understanding Amazon ECS endpoint naming patterns @@ -124 +114 @@ This behavior occurs because the Amazon ECS agent uses the [DiscoverPollEndpoint -#### The role of DiscoverPollEndpoint API +### The role of DiscoverPollEndpoint API @@ -136,0 +127,10 @@ If you're troubleshooting VPC endpoint connectivity issues, verify that your age +## Creating the VPC Endpoints for Amazon ECS + +To create the VPC endpoint for the Amazon ECS service, use the [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint) procedure in the _Amazon VPC User Guide_ to create the following endpoints. If you have existing container instances within your VPC, you should create the endpoints in the order that they're listed. If you plan on creating your container instances after your VPC endpoint is created, the order doesn't matter. + +###### Note + +If you do not configure all of the endpoints, your traffic will go over the public endpoints, not your VPC endpoint. + +When you create endpoints, Amazon ECS also creates a private DNS name for the endpoint. For example, `ecs-a.region.amazonaws.com` for ecs-agent and `ecs-t.region.amazonaws.com` for ecs-telemetry. +