AWS cli documentation change
Summary
Revised deployment controller documentation with expanded security considerations for different strategies
Security assessment
Enhanced documentation emphasizes IAM role requirements and security implications of deployment strategies, but does not indicate remediation of a specific vulnerability.
Diff
diff --git a/cli/latest/reference/ecs/delete-service.md b/cli/latest/reference/ecs/delete-service.md index 20b4fbddb..5c6444ff3 100644 --- a//cli/latest/reference/ecs/delete-service.md +++ b//cli/latest/reference/ecs/delete-service.md @@ -15 +15 @@ - * [AWS CLI 2.27.50 Command Reference](../../index.html) » + * [AWS CLI 2.27.51 Command Reference](../../index.html) » @@ -71,0 +72,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 +`delete-service` uses document type values. Document types follow the JSON data model where valid values are: strings, numbers, booleans, null, arrays, and objects. For command input, options and nested parameters that are labeled with the type `document` must be provided as JSON. Shorthand syntax does not support document types. + @@ -290,0 +293,20 @@ service -> (structure) +>>> +>>> advancedConfiguration -> (structure) +>>> +>>>> The advanced settings for the load balancer used in blue/green deployments. Specify the alternate target group, listener rules, and IAM role required for traffic shifting during blue/green deployments. +>>>> +>>>> alternateTargetGroupArn -> (string) +>>>> +>>>>> The Amazon Resource Name (ARN) of the alternate target group for Amazon ECS blue/green deployments. +>>>> +>>>> productionListenerRule -> (string) +>>>> +>>>>> The Amazon Resource Name (ARN) that identifies the production listener rule for routing production traffic. +>>>> +>>>> testListenerRule -> (string) +>>>> +>>>>> The Amazon Resource Name (ARN) that identifies the test listener rule or listener for routing test traffic. +>>>> +>>>> roleArn -> (string) +>>>> +>>>>> The Amazon Resource Name (ARN) of the IAM role that grants Amazon ECS permission to call the Elastic Load Balancing APIs for you. @@ -471,0 +494,60 @@ service -> (structure) +>> +>> strategy -> (string) +>> +>>> The deployment strategy for the service. Choose from these valid values: +>>> +>>> * `ROLLING` \- When you create a service which uses the rolling update (`ROLLING` ) deployment strategy, the Amazon ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that Amazon ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration. +>>> * `BLUE_GREEN` \- A blue/green deployment strategy (`BLUE_GREEN` ) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With Amazon ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed. +>>> + +>> +>> bakeTimeInMinutes -> (integer) +>> +>>> The duration when both blue and green service revisions are running simultaneously after the production traffic has shifted. +>>> +>>> You must provide this parameter when you use the `BLUE_GREEN` deployment strategy. +>> +>> lifecycleHooks -> (list) +>> +>>> An array of deployment lifecycle hook objects to run custom logic at specific stages of the deployment lifecycle. These hooks allow you to run custom logic at key points during the deployment process. +>>> +>>> (structure) +>>> +>>>> A deployment lifecycle hook runs custom logic at specific stages of the deployment process. Currently, you can use Lambda functions as hook targets. +>>>> +>>>> hookTargetArn -> (string) +>>>> +>>>>> The Amazon Resource Name (ARN) of the hook target. Currently, only Lambda function ARNs are supported. +>>>>> +>>>>> You must provide this parameter when configuring a deployment lifecycle hook. +>>>> +>>>> roleArn -> (string) +>>>> +>>>>> The Amazon Resource Name (ARN) of the IAM role that grants Amazon ECS permission to call Lambda functions on your behalf. +>>>>> +>>>>> For more information, see [Permissions required for Lambda functions in Amazon ECS blue/green deployments](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/blue-green-permissions.html) in the*Amazon Elastic Container Service Developer Guide* . +>>>> +>>>> lifecycleStages -> (list) +>>>> +>>>>> The lifecycle stages at which to run the hook. Choose from these valid values: +>>>>> +>>>>> * RECONCILE_SERVICE This stage only happens when you start a new service deployment with more than 1 service revision in an ACTIVE state. You can use a lifecycle hook for this stage. +>>>>> * PRE_SCALE_UP The green service revision has not started. The blue service revision is handling 100% of the production traffic. There is no test traffic. You can use a lifecycle hook for this stage. +>>>>> * SCALE_UP The time when the green service revision scales up to 100% and launches new tasks. The green service revision is not serving any traffic at this point. You can’t use a lifecycle hook for this stage. +>>>>> * POST_SCALE_UP The green service revision has started. The blue service revision is handling 100% of the production traffic. There is no test traffic. You can use a lifecycle hook for this stage. +>>>>> * TEST_TRAFFIC_SHIFT The blue and green service revisions are running. The blue service revision handles 100% of the production traffic. The green service revision is migrating from 0% to 100% of test traffic. You can use a lifecycle hook for this stage. +>>>>> * POST_TEST_TRAFFIC_SHIFT The test traffic shift is complete. The green service revision handles 100% of the test traffic. You can use a lifecycle hook for this stage. +>>>>> * PRODUCTION_TRAFFIC_SHIFT Production traffic is shifting to the green service revision. The green service revision is migrating from 0% to 100% of production traffic. You can use a lifecycle hook for this stage. +>>>>> * POST_PRODUCTION_TRAFFIC_SHIFT The production traffic shift is complete. Yes +>>>>> * BAKE_TIME The duration when both blue and green service revisions are running simultaneously. You can’t use a lifecycle hook for this stage. +>>>>> * CLEAN_UP The blue service revision has completely scaled down to 0 running tasks. The green service revision is now the production service revision after this stage. You can’t use a lifecycle hook for this stage. +>>>>> + +>>>>> +>>>>> You must provide this parameter when configuring a deployment lifecycle hook. +>>>>> +>>>>> (string) +>>>> +>>>> hookDetails -> (document) +>>>> +>>>>> Optionally provide details about the hook. Use this field to pass custom parameters to your hook target (such as a Lambda function). @@ -682,0 +765,20 @@ service -> (structure) +>>>>> +>>>>> advancedConfiguration -> (structure) +>>>>> +>>>>>> The advanced settings for the load balancer used in blue/green deployments. Specify the alternate target group, listener rules, and IAM role required for traffic shifting during blue/green deployments. +>>>>>> +>>>>>> alternateTargetGroupArn -> (string) +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) of the alternate target group for Amazon ECS blue/green deployments. +>>>>>> +>>>>>> productionListenerRule -> (string) +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) that identifies the production listener rule for routing production traffic. +>>>>>> +>>>>>> testListenerRule -> (string) +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) that identifies the test listener rule or listener for routing test traffic. +>>>>>> +>>>>>> roleArn -> (string) +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) of the IAM role that grants Amazon ECS permission to call the Elastic Load Balancing APIs for you. @@ -1020,0 +1123,20 @@ service -> (structure) +>>>>>>>> +>>>>>>>> testTrafficRules -> (structure) +>>>>>>>> +>>>>>>>>> The configuration for test traffic routing rules used during blue/green deployments with Amazon ECS Service Connect. This allows you to route a portion of traffic to the new service revision of your service for testing before shifting all production traffic. +>>>>>>>>> +>>>>>>>>> header -> (structure) +>>>>>>>>> +>>>>>>>>>> The HTTP header-based routing rules that determine which requests should be routed to the new service version during blue/green deployment testing. These rules provide fine-grained control over test traffic routing based on request headers. +>>>>>>>>>> +>>>>>>>>>> name -> (string) +>>>>>>>>>> +>>>>>>>>>>> The name of the HTTP header to examine for test traffic routing. Common examples include custom headers like `X-Test-Version` or `X-Canary-Request` that can be used to identify test traffic. +>>>>>>>>>> +>>>>>>>>>> value -> (structure) +>>>>>>>>>> +>>>>>>>>>>> The header value matching configuration that determines how the HTTP header value is evaluated for test traffic routing decisions. +>>>>>>>>>>> +>>>>>>>>>>> exact -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> The exact value that the HTTP header must match for the test traffic routing rule to apply. This provides precise control over which requests are routed to the new service revision during blue/green deployments. @@ -1269 +1391 @@ service -> (structure) ->>>>>> The Amazon Resource Name (ARN) for the namespace in Cloud Map that matches the discovery name for this Service Connect resource. You can use this ARN in other integrations with Cloud Map. However, Service Connect can’t ensure connectivity outside of Amazon ECS. +>>>>>> The Amazon Resource Name (ARN) for the service in Cloud Map that matches the discovery name for this Service Connect resource. You can use this ARN in other integrations with Cloud Map. However, Service Connect can’t ensure connectivity outside of Amazon ECS. @@ -1580 +1702 @@ service -> (structure) ->>> There are three deployment controller types available: +>>> The deployment controller is the mechanism that determines how tasks are deployed for your service. The valid options are: @@ -1582 +1704 @@ service -> (structure) ->>>> ECS +>>> * ECS When you create a service which uses the `ECS` deployment controller, you can choose between the following deployment strategies: @@ -1584 +1706,9 @@ service -> (structure) ->>> The rolling update (`ECS` ) deployment type involves replacing the current running version of the container with the latest version. The number of containers Amazon ECS adds or removes from the service during a rolling update is controlled by adjusting the minimum and maximum number of healthy tasks allowed during a service deployment, as specified in the [DeploymentConfiguration](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeploymentConfiguration.html) . +>>> * `ROLLING` : When you create a service which uses the _rolling update_ (`ROLLING` ) deployment strategy, the Amazon ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that Amazon ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration. Rolling update deployments are best suited for the following scenarios: +>>> * Gradual service updates: You need to update your service incrementally without taking the entire service offline at once. +>>> * Limited resource requirements: You want to avoid the additional resource costs of running two complete environments simultaneously (as required by blue/green deployments). +>>> * Acceptable deployment time: Your application can tolerate a longer deployment process, as rolling updates replace tasks one by one. +>>> * No need for instant roll back: Your service can tolerate a rollback process that takes minutes rather than seconds. +>>> * Simple deployment process: You prefer a straightforward deployment approach without the complexity of managing multiple environments, target groups, and listeners. +>>> * No load balancer requirement: Your service doesn’t use or require a load balancer, Application Load Balancer, Network Load Balancer, or Service Connect (which are required for blue/green deployments). +>>> * Stateful applications: Your application maintains state that makes it difficult to run two parallel environments. +>>> * Cost sensitivity: You want to minimize deployment costs by not running duplicate environments during deployment. @@ -1586 +1716 @@ service -> (structure) ->>> For more information about rolling deployments, see [Deploy Amazon ECS services by replacing tasks](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-ecs.html) in the _Amazon Elastic Container Service Developer Guide_ . +>>> Rolling updates are the default deployment strategy for services and provide a balance between deployment safety and resource efficiency for many common application scenarios. @@ -1588 +1718,6 @@ service -> (structure) ->>>> CODE_DEPLOY +>>> * `BLUE_GREEN` : A _blue/green_ deployment strategy (`BLUE_GREEN` ) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With Amazon ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed. Amazon ECS blue/green deployments are best suited for the following scenarios: +>>> * Service validation: When you need to validate new service revisions before directing production traffic to them +>>> * Zero downtime: When your service requires zero-downtime deployments +>>> * Instant roll back: When you need the ability to quickly roll back if issues are detected +>>> * Load balancer requirement: When your service uses Application Load Balancer, Network Load Balancer, or Service Connect +>>> * External Use a third-party deployment controller. @@ -1590 +1725 @@ service -> (structure) ->>> The blue/green (`CODE_DEPLOY` ) deployment type uses the blue/green deployment model powered by CodeDeploy, which allows you to verify a new deployment of a service before sending production traffic to it. +>>> * Blue/green deployment (powered by CodeDeploy) CodeDeploy installs an updated version of the application as a new replacement task set and reroutes production traffic from the original application task set to the replacement task set. The original task set is terminated after a successful deployment. Use this deployment controller to verify a new deployment of a service before sending production traffic to it. @@ -1592 +1726,0 @@ service -> (structure) ->>> For more information about blue/green deployments, see [Validate the state of an Amazon ECS service before deployment](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-bluegreen.html) in the _Amazon Elastic Container Service Developer Guide_ . @@ -1594,5 +1728 @@ service -> (structure) ->>>> EXTERNAL ->>> ->>> The external (`EXTERNAL` ) deployment type enables you to use any third-party deployment controller for full control over the deployment process for an Amazon ECS service. ->>> ->>> For more information about external deployments, see [Deploy Amazon ECS services using a third-party controller](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-external.html) in the _Amazon Elastic Container Service Developer Guide_ . + @@ -1672 +1802 @@ service -> (structure) - * [AWS CLI 2.27.50 Command Reference](../../index.html) » + * [AWS CLI 2.27.51 Command Reference](../../index.html) »