AWS AmazonECS documentation change
Summary
Updated ECS CLI tutorial with restructured steps, added service creation, web server testing, and resource cleanup. Changed task definition from sleep container to nginx web server with port mappings.
Security assessment
Added explicit requirement for container instance IAM role and security group configuration guidance. While not fixing a vulnerability, it documents security best practices like IAM roles and cautions about restricting SSH access in production.
Diff
diff --git a/AmazonECS/latest/developerguide/ECS_AWSCLI_EC2.md b/AmazonECS/latest/developerguide/ECS_AWSCLI_EC2.md index e2d81e277..1eb28ea70 100644 --- a//AmazonECS/latest/developerguide/ECS_AWSCLI_EC2.md +++ b//AmazonECS/latest/developerguide/ECS_AWSCLI_EC2.md @@ -5 +5 @@ -PrerequisitesStep 1: Create a ClusterStep 2: Launch an Instance with the Amazon ECS AMIStep 3: List Container InstancesStep 4: Describe your Container InstanceStep 5: Register a Task DefinitionStep 6: List Task DefinitionsStep 7: Run a TaskStep 8: List TasksStep 9: Describe the Running Task +PrerequisitesCreate a clusterLaunch a container instance with the Amazon ECS AMIList container instancesDescribe your container instanceRegister a task definitionList task definitionsCreate a serviceList servicesDescribe the serviceDescribe the running taskTest the web serverClean up resources @@ -19 +19 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 1: Create a Cluster + * Create a cluster @@ -21 +21 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 2: Launch an Instance with the Amazon ECS AMI + * Launch a container instance with the Amazon ECS AMI @@ -23 +23 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 3: List Container Instances + * List container instances @@ -25 +25 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 4: Describe your Container Instance + * Describe your container instance @@ -27 +27 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 5: Register a Task Definition + * Register a task definition @@ -29 +29 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 6: List Task Definitions + * List task definitions @@ -31 +31 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 7: Run a Task + * Create a service @@ -33 +33 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 8: List Tasks + * List services @@ -35 +35,7 @@ You can use dual-stack service endpoints to interact with Amazon ECS from the AW - * Step 9: Describe the Running Task + * Describe the service + + * Describe the running task + + * Test the web server + + * Clean up resources @@ -50 +56,3 @@ This tutorial assumes that the following prerequisites have been completed: - * You have a VPC and security group created to use. For more information, see [Create a virtual private cloud](./get-set-up-for-amazon-ecs.html#create-a-vpc). + * You have a container instance IAM role created to use. For more informaton, see [Amazon ECS container instance IAM role](./instance_IAM_role.html). + + * You have a VPC created to use. For more information, see [Create a virtual private cloud](./get-set-up-for-amazon-ecs.html#create-a-vpc). @@ -57 +65 @@ This tutorial assumes that the following prerequisites have been completed: -## Step 1: Create a Cluster +## Create a cluster @@ -81 +89,82 @@ Output: -## Step 2: Launch an Instance with the Amazon ECS AMI +## Launch a container instance with the Amazon ECS AMI + +Container instances are EC2 instances that run the Amazon ECS container agent and have been registered into a cluster. In this section, you'll launch an EC2 instance using the ECS-optimized AMI. + +###### To launch a container instance with the AWS CLI + + 1. Retrieve the latest ECS-optimized Amazon Linux 2 AMI ID for your AWS Region using the following command. This command uses AWS Systems Manager Parameter Store to get the latest ECS-optimized AMI ID. The AMI includes the Amazon ECS container agent and Docker runtime pre-installed. + + aws ssm get-parameters --names /aws/service/ecs/optimized-ami/amazon-linux-2/recommended --query 'Parameters[0].Value' --output text | jq -r '.image_id' + +Output: + + ami-abcd1234 + + 2. Create a security group that allows SSH access for managing your container instance and HTTP access for the web server. + + aws ec2 create-security-group --group-name ecs-tutorial-sg --description "ECS tutorial security group" + +Output: + + { + "GroupId": "sg-abcd1234" + } + + 3. Add an inbound rule to the security group by running the following command. + + aws ec2 authorize-security-group-ingress --group-id sg-abcd1234 --protocol tcp --port 80 --cidr 0.0.0.0/0 + +Output: + + { + "Return": true, + "SecurityGroupRules": [ + { + "SecurityGroupRuleId": "sgr-efgh5678", + "GroupId": "sg-abcd1234", + "GroupOwnerId": "123456789012", + "IsEgress": false, + "IpProtocol": "tcp", + "FromPort": 80, + "ToPort": 80, + "CidrIpv4": "0.0.0.0/0" + } + ] + } + +The security group now allows SSH access from the specified IP range and HTTP access from anywhere. In a production environment, you should restrict SSH access to your specific IP address and consider limiting HTTP access as needed. + + 4. Create an EC2 key pair for SSH access to your container instance. + + aws ec2 create-key-pair --key-name ecs-tutorial-key --query 'KeyMaterial' --output text > ecs-tutorial-key.pem + chmod 400 ecs-tutorial-key.pem + +The private key is saved to your local machine with appropriate permissions for SSH access. + + 5. Launch an EC2 instance using the ECS-optimized AMI and configure it to join your cluster. + + aws ec2 run-instances --image-id ami-abcd1234 --instance-type t3.micro --key-name ecs-tutorial-key --security-group-ids sg-abcd1234 --iam-instance-profile Name=ecsInstanceRole --user-data '#!/bin/bash + echo ECS_CLUSTER=MyCluster >> /etc/ecs/ecs.config' + { + "Instances": [ + { + "InstanceId": "i-abcd1234", + "ImageId": "ami-abcd1234", + "State": { + "Code": 0, + "Name": "pending" + }, + "PrivateDnsName": "", + "PublicDnsName": "", + "StateReason": { + "Code": "pending", + "Message": "pending" + }, + "InstanceType": "t3.micro", + "KeyName": "ecs-tutorial-key", + "LaunchTime": "2025-01-13T10:30:00.000Z" + } + ] + } + +The user data script configures the Amazon ECS agent to register the instance with your `MyCluster`. The instance uses the `ecsInstanceRole` IAM role, which provides the necessary permissions for the agent. @@ -83 +171,0 @@ Output: -You must have an Amazon ECS container instance in your cluster before you can run tasks on it. If you do not have any container instances in your cluster, see [Launching an Amazon ECS Linux container instance](./launch_container_instance.html) for more information. @@ -85 +173,3 @@ You must have an Amazon ECS container instance in your cluster before you can ru -## Step 3: List Container Instances + + +## List container instances @@ -101 +191 @@ Output: -## Step 4: Describe your Container Instance +## Describe your container instance @@ -106 +196 @@ After you have the ARN or ID of a container instance, you can use the **describe - aws ecs describe-container-instances --cluster default --container-instances container_instance_ID + aws ecs describe-container-instances --cluster MyCluster --container-instances container_instance_ID @@ -226 +316 @@ You can also find the Amazon EC2 instance ID that you can use to monitor the ins -## Step 5: Register a Task Definition +## Register a task definition @@ -228 +318 @@ You can also find the Amazon EC2 instance ID that you can use to monitor the ins -Before you can run a task on your ECS cluster, you must register a task definition. Task definitions are lists of containers grouped together. The following example is a simple task definition that uses a `busybox` image from Docker Hub and simply sleeps for 360 seconds. For more information about the available task definition parameters, see [Amazon ECS task definitions](./task_definitions.html). +Before you can run a task on your Amazon ECS cluster, you must register a task definition. Task definitions are lists of containers grouped together. The following example is a simple task definition that uses an `nginx` image. For more information about the available task definition parameters, see [Amazon ECS task definitions](./task_definitions.html). @@ -231,0 +322 @@ Before you can run a task on your ECS cluster, you must register a task definiti + "family": "nginx-task", @@ -234,9 +325,12 @@ Before you can run a task on your ECS cluster, you must register a task definiti - "name": "sleep", - "image": "busybox", - "cpu": 10, - "command": [ - "sleep", - "360" - ], - "memory": 10, - "essential": true + "name": "nginx", + "image": "public.ecr.aws/ecs-sample-image/amazon-ecs-sample:latest", + "cpu": 256, + "memory": 512, + "essential": true, + "portMappings": [ + { + "containerPort": 80, + "hostPort": 80, + "protocol": "tcp" + } + ] @@ -245 +339,2 @@ Before you can run a task on your ECS cluster, you must register a task definiti - "family": "sleep360" + "requiresCompatibilities": ["EC2"], + "networkMode": "bridge" @@ -248 +343 @@ Before you can run a task on your ECS cluster, you must register a task definiti -The above example JSON can be passed to the AWS CLI in two ways: You can save the task definition JSON as a file and pass it with the ``\--cli-input-json` file://`path_to_file.json`` option. Or, you can escape the quotation marks in the JSON and pass the JSON container definitions on the command line as in the below example. If you choose to pass the container definitions on the command line, your command additionally requires a `--family` parameter that is used to keep multiple versions of your task definition associated with each other. +The above example JSON can be passed to the AWS CLI in two ways: You can save the task definition JSON as a file and pass it with the ``\--cli-input-json` file://`path_to_file.json`` option. Or, you can escape the quotation marks in the JSON and pass the JSON container definitions on the command line. If you choose to pass the container definitions on the command line, your command additionally requires a `--family` parameter that is used to keep multiple versions of your task definition associated with each other. @@ -253,6 +348 @@ To use a JSON file for container definitions: - aws ecs register-task-definition --cli-input-json file://$HOME/tasks/sleep360.json - -To use a JSON string for container definitions: - - - aws ecs register-task-definition --family sleep360 --container-definitions "[{\"name\":\"sleep\",\"image\":\"busybox\",\"cpu\":10,\"command\":[\"sleep\",\"360\"],\"memory\":10,\"essential\":true}]" + aws ecs register-task-definition --cli-input-json file://$HOME/tasks/nginx.json @@ -265,2 +355,4 @@ The **register-task-definition** returns a description of the task definition af - "volumes": [], - "taskDefinitionArn": "arn:aws:ec2:us-east-1:aws_account_id:task-definition/sleep360:1", + "taskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/nginx-task:1", + "family": "nginx-task", + "revision": 1, + "status": "ACTIVE", @@ -268,0 +361,12 @@ The **register-task-definition** returns a description of the task definition af + "name": "nginx", + "image": "public.ecr.aws/docker/library/nginx:latest",