AWS AmazonECS medium security documentation change
Summary
Updated cluster creation documentation with Container Insights guidance, IPv6 configuration notes, and security group inbound rule requirements
Security assessment
The change explicitly requires specifying at least one inbound rule when creating new security groups, which enforces network security best practices. This reduces exposure to unintended open ports. The IPv6-only subnet guidance also ensures proper network configuration alignment.
Diff
diff --git a/AmazonECS/latest/developerguide/create-ec2-cluster-console-v2.md b/AmazonECS/latest/developerguide/create-ec2-cluster-console-v2.md index eaf636d8f..0948a773f 100644 --- a//AmazonECS/latest/developerguide/create-ec2-cluster-console-v2.md +++ b//AmazonECS/latest/developerguide/create-ec2-cluster-console-v2.md @@ -7 +7 @@ Auto Scaling group optionsNetworking optionsNext steps -# Creating an Amazon ECS cluster for the Amazon EC2 launch type +# Creating an Amazon ECS cluster for Amazon EC2 workloads @@ -26,0 +27,8 @@ A namespace allows services that you create in the cluster can connect to the ot + * Turn on Container Insights with enhanced observability, or Container Insights . + +CloudWatch Container Insights collects, aggregates, and summarizes metrics and logs from your containerized applications and microservices. Container Insights also provides diagnostic information, such as container restart failures, that you use to isolate issues and resolve them quickly. For more information, see [Monitor Amazon ECS containers using Container Insights with enhanced observability](./cloudwatch-container-insights.html). + +After you configure Container Insights with enhanced observability on Amazon ECS, Container Insights auto-collects detailed infrastructure telemetry from the cluster level down to the container level in your environment and displays your data in dashboards that show you a variety of metrics and dimensions. You can then use these out-of-the-box dashboards on the Container Insights console to better understand your container health and performance, and to mitigate issues faster by identifying anomalies. + +We recommend that you use Container Insights with enhanced observability instead of Container Insights because it provides detailed visibility in your container environment, reducing the mean time to resolution. + @@ -76 +84,3 @@ By default instances are launched into the default subnets for the Region. The s -You can choose an existing subnet. You can either use an existing security group, or create a new one, When you create a new security group, you need to specify at least one inbound rule. +You can choose an existing subnet. You can either use an existing security group, or create a new one. To create tasks in an IPv6-only configuration, use subnets that include only an IPv6 CIDR block. + +When you create a new security group, you need to specify at least one inbound rule. @@ -115 +125 @@ The name can contain up to 255 letters (uppercase and lowercase), numbers, and h - 6. Add Amazon EC2 instances to your cluster, expand **Infrastructure** and then select **Amazon EC2 instances**. + 6. Add Amazon EC2 instances to your cluster, expand **Infrastructure** and then select **Fargate and Self-managed instances**. @@ -151 +161 @@ For more information, see [Amazon ECS container instance IAM role](./instance_IA - * To change to a VPC other than the **default** VPC, under **VPC** , choose an existing **VPC** , and then under **Subnets** , choose the subnets. + * To change to a VPC other than the **default** VPC, under **VPC** , choose an existing **VPC** , and then under **Subnets** , choose the subnets. For an IPv6-only configuration, choose a VPC that has an IPv6 CIDR block and subnets that have only an IPv6 CIDR block.