AWS AmazonECS documentation change
Summary
Added detailed documentation about deployment controller types, valid transitions between controllers, and operational considerations when updating deployment controllers. Clarified EBS volume configuration behavior.
Security assessment
The changes primarily document deployment controller workflows and configuration constraints. While they mention operational risks (like CloudFormation errors during rollbacks), there's no evidence of addressing security vulnerabilities or describing security-specific features. The encryption mention in EBS configuration refers to existing capabilities rather than new security documentation.
Diff
diff --git a/AmazonECS/latest/developerguide/update-service-parameters.md b/AmazonECS/latest/developerguide/update-service-parameters.md index b6a57c654..e919b37ba 100644 --- a//AmazonECS/latest/developerguide/update-service-parameters.md +++ b//AmazonECS/latest/developerguide/update-service-parameters.md @@ -100,0 +101,65 @@ If the `maximumPercent` parameter limits the scheduler from starting a replaceme +**Deployment controller** + + +The deployment controller to use for the service. There are three deployment controller types available: + + * `ECS` + + * `EXTERNAL` + + * `CODE_DEPLOY` + + + + +When you update a service, you can update the deployment controller it uses. The following list provides the valid transitions: + + * Update from CodeDeploy blue/green deployments (`CODE_DEPLOY`) to ECS rolling or blue/green deployments (`ECS`). + + * Update from CodeDeploy blue/green deployments (`CODE_DEPLOY`) to external deployments (`EXTERNAL`). + + * Update from ECS rolling or blue/green deployments (`ECS`) to external deployments (`EXTERNAL`). + + * Update from external deployments (`EXTERNAL`) to ECS rolling or blue/green deployments (`ECS`). + + + + +Consider the following when you update a service's deployment controller: + + * You can't update the deployment controller of a service from the `ECS` deployment controller to any of the other controllers if it uses VPC Lattice or Amazon ECS Service Connect. + + * You can't update the deployment controller of a service during an ongoing service deployment. + + * You can't update the deployment controller of a service to `CODE_DEPLOY` if there are no load balancers on the service. + + * You can't update the deployment controller of a service from `ECS` to any of the other controllers if the `deploymentConfiguration` includes alarms, a deployment circuit breaker, or a `BLUE_GREEN` deployment strategy. For more information, see [Amazon ECS service deployment controllers and strategies](./ecs_service-options.html). + + * The value you specify for `versionConsistency` in the container definition won't be used by Amazon ECS if you update the deployment controller of the service from `ECS` to any of the other controllers. + + * If you update a service's deployment controller from `ECS` to any of the other controllers, the `UpdateService` and `DescribeService` API responses will still return `deployments` instead of `taskSets`. For more information about `UpdateService` and `CreateService`, see [UpdateService](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Service.html) and [CreateService](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Service.html) in the _Amazon ECS API Reference_. + + * If a service uses a rolling update deployment strategy, updating the deployment controller from `ECS` to any of the other controllers will change how the `maximumPercent` value in the `deploymentConfiguration` is used. Instead of just being used as a cap on total tasks in a rolling update deployment, `maximumPercent` is used for replacing unhealthy tasks. For more information on how the scheduler replaces unhealthy tasks, see [Amazon ECS services](./ecs_services.html). + + * If you update a service's deployment controller from `ECS` to any of the other deployment controllers, any `advancedConfiguration` that you specify with your load balancer configuration will be ignored. For more information, see [LoadBalancer](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_LoadBalancer.html) and [AdvancedConfiguration](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_AdvancedConfiguration.html) in the _Amazon ECS API reference_. + + + + +When updating the deployment controller for a service using CloudFormation, consider the following depending on the type of migration you're performing. + + * If you have a CloudFormation template that contains the `EXTERNAL` deployment controller information as well as `TaskSet` and `PrimaryTaskSet` resources, and you remove the task set resources from the template when updating from `EXTERNAL` to `ECS`, the `DescribeTaskSet` and `DeleteTaskSet` API calls will return a 400 error after the deployment controller is updated to `ECS`. This results in a CloudFormation delete failure on the task set resources, even though the CloudFormation stack transitions to `UPDATE_COMPLETE` status. For more information, see [Resource removed from stack but not deleted](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-resource-removed-not-deleted) in the AWS CloudFormation User Guide. To fix this issue, delete the task sets directly using the Amazon ECS `DeleteTaskSet` API. For more information about how to delete a task set, see [DeleteTaskSet](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html) in the _Amazon Elastic Container Service_ _API Reference_. + + * If you're migrating from `CODE_DEPLOY` to `ECS` with a new task definition and CloudFormation performs a rollback operation, the Amazon ECS `UpdateService` request fails with the following error: + + Resource handler returned message: "Invalid request provided: Unable to update + task definition on services with a CODE_DEPLOY deployment controller. Use AWS + CodeDeploy to trigger a new deployment. (Service: Ecs, Status Code: 400, + Request ID: 0abda1e2-f7b3-4e96-b6e9-c8bc585181ac) (SDK Attempt Count: 1)" + (RequestToken: ba8767eb-c99e-efed-6ec8-25011d9473f0, HandlerErrorCode: InvalidRequest) + + * After a successful migration from `ECS` to `EXTERNAL` deployment controller, you need to manually remove the `ACTIVE` task set, because Amazon ECS no longer manages the deployment. For information about how to delete a task set, see [DeleteTaskSet](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html) in the Amazon Elastic Container Service _API Reference_. + + + + @@ -244 +309 @@ You can change this parameter for rolling deployments. -The details of the volume that was `configuredAtLaunch`. When set to true, this parameter configures the Amazon EBS task attachment during deployment. You can configure the size, volumeType, IOPS, throughput, snapshot and encryption in [ServiceManagedEBSVolumeConfiguration](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ServiceManagedEBSVolumeConfiguration.html). The `name` of the volume must match the `name` from the task definition. If set to null, no new deployment is triggered. Otherwise, if this configuration differs from the existing one, it triggers a new deployment. +The details of the volume that was `configuredAtLaunch`. When `configuredAtLaunch` is set to `true` in the task definition, this service parameter configures one Amazon EBS volume for each task in the service to be created and attached during deployment. You can configure the size, volumeType, IOPS, throughput, snapshot and encryption in [ServiceManagedEBSVolumeConfiguration](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ServiceManagedEBSVolumeConfiguration.html). The `name` of the volume must match the `name` from the task definition. If set to null, no new deployment is triggered. Otherwise, if this configuration differs from the existing one, it triggers a new deployment. @@ -308 +373 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Creating a service +Amazon ECS fault injection endpoints