AWS cli documentation change
Summary
Updated documentation for ECS update-service command with new deployment controller options, blue/green deployment strategy details, lifecycle hooks configuration, and advanced load balancer settings
Security assessment
The changes add documentation about IAM role requirements (roleArn) for Lambda lifecycle hooks and load balancer configurations, which are security-related features. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/cli/latest/reference/ecs/update-service.md b/cli/latest/reference/ecs/update-service.md index feb889eb5..618ce7a08 100644 --- a//cli/latest/reference/ecs/update-service.md +++ b//cli/latest/reference/ecs/update-service.md @@ -15 +15 @@ - * [AWS CLI 2.27.50 Command Reference](../../index.html) » + * [AWS CLI 2.27.51 Command Reference](../../index.html) » @@ -110,0 +111,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 +`update-service` uses document type values. Document types follow the JSON data model where valid values are: strings, numbers, booleans, null, arrays, and objects. For command input, options and nested parameters that are labeled with the type `document` must be provided as JSON. Shorthand syntax does not support document types. + @@ -127,0 +130 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 + [--deployment-controller <value>] @@ -332,0 +336,8 @@ JSON Syntax: +> +> strategy -> (string) +> +>> The deployment strategy for the service. Choose from these valid values: +>> +>> * `ROLLING` \- When you create a service which uses the rolling update (`ROLLING` ) deployment strategy, the Amazon ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that Amazon ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration. +>> * `BLUE_GREEN` \- A blue/green deployment strategy (`BLUE_GREEN` ) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With Amazon ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed. +>> @@ -334,4 +345,42 @@ JSON Syntax: -Shorthand Syntax: - - - deploymentCircuitBreaker={enable=boolean,rollback=boolean},maximumPercent=integer,minimumHealthyPercent=integer,alarms={alarmNames=[string,string],rollback=boolean,enable=boolean} +> +> bakeTimeInMinutes -> (integer) +> +>> The duration when both blue and green service revisions are running simultaneously after the production traffic has shifted. +>> +>> You must provide this parameter when you use the `BLUE_GREEN` deployment strategy. +> +> lifecycleHooks -> (list) +> +>> An array of deployment lifecycle hook objects to run custom logic at specific stages of the deployment lifecycle. These hooks allow you to run custom logic at key points during the deployment process. +>> +>> (structure) +>> +>>> A deployment lifecycle hook runs custom logic at specific stages of the deployment process. Currently, you can use Lambda functions as hook targets. +>>> +>>> hookTargetArn -> (string) +>>> +>>>> The Amazon Resource Name (ARN) of the hook target. Currently, only Lambda function ARNs are supported. +>>>> +>>>> You must provide this parameter when configuring a deployment lifecycle hook. +>>> +>>> roleArn -> (string) +>>> +>>>> The Amazon Resource Name (ARN) of the IAM role that grants Amazon ECS permission to call Lambda functions on your behalf. +>>>> +>>>> For more information, see [Permissions required for Lambda functions in Amazon ECS blue/green deployments](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/blue-green-permissions.html) in the*Amazon Elastic Container Service Developer Guide* . +>>> +>>> lifecycleStages -> (list) +>>> +>>>> The lifecycle stages at which to run the hook. Choose from these valid values: +>>>> +>>>> * RECONCILE_SERVICE This stage only happens when you start a new service deployment with more than 1 service revision in an ACTIVE state. You can use a lifecycle hook for this stage. +>>>> * PRE_SCALE_UP The green service revision has not started. The blue service revision is handling 100% of the production traffic. There is no test traffic. You can use a lifecycle hook for this stage. +>>>> * SCALE_UP The time when the green service revision scales up to 100% and launches new tasks. The green service revision is not serving any traffic at this point. You can’t use a lifecycle hook for this stage. +>>>> * POST_SCALE_UP The green service revision has started. The blue service revision is handling 100% of the production traffic. There is no test traffic. You can use a lifecycle hook for this stage. +>>>> * TEST_TRAFFIC_SHIFT The blue and green service revisions are running. The blue service revision handles 100% of the production traffic. The green service revision is migrating from 0% to 100% of test traffic. You can use a lifecycle hook for this stage. +>>>> * POST_TEST_TRAFFIC_SHIFT The test traffic shift is complete. The green service revision handles 100% of the test traffic. You can use a lifecycle hook for this stage. +>>>> * PRODUCTION_TRAFFIC_SHIFT Production traffic is shifting to the green service revision. The green service revision is migrating from 0% to 100% of production traffic. You can use a lifecycle hook for this stage. +>>>> * POST_PRODUCTION_TRAFFIC_SHIFT The production traffic shift is complete. Yes +>>>> * BAKE_TIME The duration when both blue and green service revisions are running simultaneously. You can’t use a lifecycle hook for this stage. +>>>> * CLEAN_UP The blue service revision has completely scaled down to 0 running tasks. The green service revision is now the production service revision after this stage. You can’t use a lifecycle hook for this stage. +>>>> @@ -338,0 +388,8 @@ Shorthand Syntax: +>>>> +>>>> You must provide this parameter when configuring a deployment lifecycle hook. +>>>> +>>>> (string) +>>> +>>> hookDetails -> (document) +>>> +>>>> Optionally provide details about the hook. Use this field to pass custom parameters to your hook target (such as a Lambda function). @@ -353,0 +411,9 @@ JSON Syntax: + }, + "strategy": "ROLLING"|"BLUE_GREEN", + "bakeTimeInMinutes": integer, + "lifecycleHooks": [ + { + "hookTargetArn": "string", + "roleArn": "string", + "lifecycleStages": ["RECONCILE_SERVICE"|"PRE_SCALE_UP"|"POST_SCALE_UP"|"TEST_TRAFFIC_SHIFT"|"POST_TEST_TRAFFIC_SHIFT"|"PRODUCTION_TRAFFIC_SHIFT"|"POST_PRODUCTION_TRAFFIC_SHIFT", ...], + "hookDetails": {...} @@ -354,0 +421,2 @@ JSON Syntax: + ... + ] @@ -521,0 +590,50 @@ JSON Syntax: +`--deployment-controller` (structure) + +> The deployment controller to use for the service. +> +> type -> (string) +> +>> The deployment controller type to use. +>> +>> The deployment controller is the mechanism that determines how tasks are deployed for your service. The valid options are: +>> +>> * ECS When you create a service which uses the `ECS` deployment controller, you can choose between the following deployment strategies: +>> +>> * `ROLLING` : When you create a service which uses the _rolling update_ (`ROLLING` ) deployment strategy, the Amazon ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that Amazon ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration. Rolling update deployments are best suited for the following scenarios: +>> * Gradual service updates: You need to update your service incrementally without taking the entire service offline at once. +>> * Limited resource requirements: You want to avoid the additional resource costs of running two complete environments simultaneously (as required by blue/green deployments). +>> * Acceptable deployment time: Your application can tolerate a longer deployment process, as rolling updates replace tasks one by one. +>> * No need for instant roll back: Your service can tolerate a rollback process that takes minutes rather than seconds. +>> * Simple deployment process: You prefer a straightforward deployment approach without the complexity of managing multiple environments, target groups, and listeners. +>> * No load balancer requirement: Your service doesn’t use or require a load balancer, Application Load Balancer, Network Load Balancer, or Service Connect (which are required for blue/green deployments). +>> * Stateful applications: Your application maintains state that makes it difficult to run two parallel environments. +>> * Cost sensitivity: You want to minimize deployment costs by not running duplicate environments during deployment. +>> +>> Rolling updates are the default deployment strategy for services and provide a balance between deployment safety and resource efficiency for many common application scenarios. +>> +>> * `BLUE_GREEN` : A _blue/green_ deployment strategy (`BLUE_GREEN` ) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With Amazon ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed. Amazon ECS blue/green deployments are best suited for the following scenarios: +>> * Service validation: When you need to validate new service revisions before directing production traffic to them +>> * Zero downtime: When your service requires zero-downtime deployments +>> * Instant roll back: When you need the ability to quickly roll back if issues are detected +>> * Load balancer requirement: When your service uses Application Load Balancer, Network Load Balancer, or Service Connect +>> * External Use a third-party deployment controller. +>> +>> * Blue/green deployment (powered by CodeDeploy) CodeDeploy installs an updated version of the application as a new replacement task set and reroutes production traffic from the original application task set to the replacement task set. The original task set is terminated after a successful deployment. Use this deployment controller to verify a new deployment of a service before sending production traffic to it. +>> +>> + + +Shorthand Syntax: + + + type=string + + +JSON Syntax: + + + { + "type": "ECS"|"CODE_DEPLOY"|"EXTERNAL" + } + + @@ -590,0 +709,20 @@ JSON Syntax: +>> +>> advancedConfiguration -> (structure) +>> +>>> The advanced settings for the load balancer used in blue/green deployments. Specify the alternate target group, listener rules, and IAM role required for traffic shifting during blue/green deployments. +>>> +>>> alternateTargetGroupArn -> (string) +>>> +>>>> The Amazon Resource Name (ARN) of the alternate target group for Amazon ECS blue/green deployments. +>>> +>>> productionListenerRule -> (string) +>>> +>>>> The Amazon Resource Name (ARN) that identifies the production listener rule for routing production traffic. +>>> +>>> testListenerRule -> (string) +>>> +>>>> The Amazon Resource Name (ARN) that identifies the test listener rule or listener for routing test traffic. +>>> +>>> roleArn -> (string) +>>> +>>>> The Amazon Resource Name (ARN) of the IAM role that grants Amazon ECS permission to call the Elastic Load Balancing APIs for you. @@ -595 +733 @@ Shorthand Syntax: - targetGroupArn=string,loadBalancerName=string,containerName=string,containerPort=integer ... + targetGroupArn=string,loadBalancerName=string,containerName=string,containerPort=integer,advancedConfiguration={alternateTargetGroupArn=string,productionListenerRule=string,testListenerRule=string,roleArn=string} ... @@ -606 +744,7 @@ JSON Syntax: - "containerPort": integer + "containerPort": integer, + "advancedConfiguration": { + "alternateTargetGroupArn": "string", + "productionListenerRule": "string", + "testListenerRule": "string", + "roleArn": "string" + } @@ -750,0 +895,20 @@ JSON Syntax: +>>>>> +>>>>> testTrafficRules -> (structure) +>>>>> +>>>>>> The configuration for test traffic routing rules used during blue/green deployments with Amazon ECS Service Connect. This allows you to route a portion of traffic to the new service revision of your service for testing before shifting all production traffic. +>>>>>> +>>>>>> header -> (structure) +>>>>>> +>>>>>>> The HTTP header-based routing rules that determine which requests should be routed to the new service version during blue/green deployment testing. These rules provide fine-grained control over test traffic routing based on request headers. +>>>>>>> +>>>>>>> name -> (string) +>>>>>>> +>>>>>>>> The name of the HTTP header to examine for test traffic routing. Common examples include custom headers like `X-Test-Version` or `X-Canary-Request` that can be used to identify test traffic. +>>>>>>> +>>>>>>> value -> (structure) +>>>>>>> +>>>>>>>> The header value matching configuration that determines how the HTTP header value is evaluated for test traffic routing decisions. +>>>>>>>> +>>>>>>>> exact -> (string) +>>>>>>>> +>>>>>>>>> The exact value that the HTTP header must match for the test traffic routing rule to apply. This provides precise control over which requests are routed to the new service revision during blue/green deployments. @@ -992 +1156,9 @@ JSON Syntax: - "dnsName": "string" + "dnsName": "string", + "testTrafficRules": { + "header": {