AWS AmazonECS documentation change
Summary
Added warning about sidecar containers making API calls and CloudTrail debugging reference
Security assessment
Highlights operational risks of API throttling from sidecar containers and adds CloudTrail monitoring guidance. While improving security awareness, it doesn't address a specific vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/task-metadata-endpoint-v4.md b/AmazonECS/latest/developerguide/task-metadata-endpoint-v4.md index 29f4ff186..ded78238f 100644 --- a//AmazonECS/latest/developerguide/task-metadata-endpoint-v4.md +++ b//AmazonECS/latest/developerguide/task-metadata-endpoint-v4.md @@ -50 +50 @@ This endpoint requires the `ecs.ListTagsForResource` permission. -When using the `${ECS_CONTAINER_METADATA_URI_V4}/taskWithTags` endpoint, be aware that each call makes up to two API requests to `ecs:ListTagsForResource` (one for container instance tags and one for task tags). This can lead to API throttling if called frequently. +When using the `${ECS_CONTAINER_METADATA_URI_V4}/taskWithTags` endpoint, be aware that each call makes up to two API requests to `ecs:ListTagsForResource` (one for container instance tags and one for task tags) and that any sidecar containers in the task may make these calls on your behalf. Frequent endpoint calls can result in API throttling. @@ -52 +52 @@ When using the `${ECS_CONTAINER_METADATA_URI_V4}/taskWithTags` endpoint, be awar -Consider implementing caching or batching strategies to reduce the frequency of calls, especially in high-traffic applications. For information about throttling limits for the `ListTagsForResource` API, see [Request throttling for the Amazon ECS API](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/request-throttling.html). +Consider implementing caching or batching strategies to reduce the frequency of calls, especially in high-traffic applications, and debugging API throttling issues using AWS CloudTrail. For information about throttling limits for the `ListTagsForResource` API, see [Request throttling for the Amazon ECS API](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/request-throttling.html) in the _Amazon Elastic Container Service API Reference_. For more information about debugging Amazon ECS API calls using AWS CloudTrail, see [Log Amazon ECS API calls using AWS CloudTrail](./logging-using-cloudtrail.html).