AWS AmazonECS documentation change
Summary
Updated documentation about EBS volume configuration, encryption details, and supported platforms. Changes include clarifying volume management by ECS, adding KMS encryption documentation, restructuring configuration guidance, and updating supported capacity types.
Security assessment
The change explicitly adds documentation about encrypting EBS volumes with AWS KMS keys ('Amazon EBS volumes attached to tasks can be encrypted with AWS Key Management Service (AWS KMS) keys to protect your data'), which is a security feature. However, there is no evidence this addresses a specific security vulnerability - it simply documents existing security capabilities.
Diff
diff --git a/AmazonECS/latest/developerguide/ebs-volumes.md b/AmazonECS/latest/developerguide/ebs-volumes.md index 0a4df1342..f0332b8e5 100644 --- a//AmazonECS/latest/developerguide/ebs-volumes.md +++ b//AmazonECS/latest/developerguide/ebs-volumes.md @@ -5 +5 @@ -Supported operating systems and launch typesConsiderations +Supported operating systems and capacityConsiderations @@ -9 +9 @@ Supported operating systems and launch typesConsiderations -Amazon Elastic Block Store (Amazon EBS) volumes provide highly available, cost-effective, durable, high-performance block storage for data-intensive workloads. Amazon EBS volumes can be used with Amazon ECS tasks for high throughput and transaction-intensive applications. +Amazon Elastic Block Store (Amazon EBS) volumes provide highly available, cost-effective, durable, high-performance block storage for data-intensive workloads. Amazon EBS volumes can be used with Amazon ECS tasks for high throughput and transaction-intensive applications. For more information about Amazon EBS volumes, see [Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volumes.html) in the _Amazon EBS User Guide_. @@ -11 +11 @@ Amazon Elastic Block Store (Amazon EBS) volumes provide highly available, cost-e -During standalone task launch, you can provide the configuration that will be used to attach one EBS volume to the task. During service creation or update, you can provide the configuration that will be used to attach one EBS volume per task to each task managed by the Amazon ECS service. +Amazon EBS volumes that are attached to Amazon ECS tasks are managed by Amazon ECS on your behalf. During standalone task launch, you can provide the configuration that will be used to attach one EBS volume to the task. During service creation or update, you can provide the configuration that will be used to attach one EBS volume per task to each task managed by the Amazon ECS service. You can either configure new, empty volumes for attachment, or you can use snapshots to load data from existing volumes. @@ -13 +13 @@ During standalone task launch, you can provide the configuration that will be us -By providing volume configuration at launch time rather than in the task definition, you create task definitions that aren't constrained to a specific data volume type or specific EBS volume settings. You can then reuse your task definitions across different runtime environments. For example, you can provide more throughput during deployment for your production workloads than your pre-prod environments. +###### Note @@ -15 +15,5 @@ By providing volume configuration at launch time rather than in the task definit -Amazon EBS volumes that are attached to Amazon ECS tasks are managed by Amazon ECS on your behalf. The volumes can be encrypted with AWS Key Management Service (AWS KMS) keys to protect your data. You can either configure new, empty volumes for attachment, or you can use snapshots to load data from existing volumes. When you use snapshots to configure volumes, you can specify a `volumeInitializationRate`, in MiB/s, at which data is fetched from the snapshot to create volumes that are fully initialized in a predictable amount of time. For more information about volume initialization, see [Initialize Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/initalize-volume.html) in the _Amazon EBS User Guide_. For more information about configuring Amazon EBS volumes, see [Defer volume configuration to launch time in an Amazon ECS task definition](./specify-ebs-config.html) and [Specify Amazon EBS volume configuration at Amazon ECS deployment](./configure-ebs-volume.html). +When you use snapshots to configure volumes, you can specify a `volumeInitializationRate`, in MiB/s, at which data is fetched from the snapshot to create volumes that are fully initialized in a predictable amount of time. For more information about volume initialization, see [Initialize Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/initalize-volume.html) in the _Amazon EBS User Guide_. For more information about configuring Amazon EBS volumes, see [Defer volume configuration to launch time in an Amazon ECS task definition](./specify-ebs-config.html) and [Specify Amazon EBS volume configuration at Amazon ECS deployment](./configure-ebs-volume.html). + +Volume configuration is deferred to launch time using the `configuredAtLaunch` parameter in the task definition. By providing volume configuration at launch time rather than in the task definition, you get to create task definitions that aren't constrained to a specific data volume type or specific EBS volume settings. You can then reuse your task definitions across different runtime environments. For example, you can provide more throughput during deployment for your production workloads than your pre-prod environments. + +Amazon EBS volumes attached to tasks can be encrypted with AWS Key Management Service (AWS KMS) keys to protect your data. For more information see, [Encrypt data stored in Amazon EBS volumes attached to Amazon ECS tasks](./ebs-kms-encryption.html). @@ -21,3 +25 @@ Attaching an Amazon EBS volume to a task is supported in all commercial and Chin -For more information about Amazon EBS volumes, see [Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volumes.html) in the _Amazon EBS User Guide_. - -## Supported operating systems and launch types +## Supported operating systems and capacity @@ -25 +27 @@ For more information about Amazon EBS volumes, see [Amazon EBS volumes](https:// -The following table provides the supported operating system and launch type configurations. +The following table provides the supported operating system and capacity configurations. @@ -27 +29 @@ The following table provides the supported operating system and launch type conf -Launch type | Linux | Windows +Capacity | Linux | Windows @@ -30 +32,2 @@ Fargate | Amazon EBS volumes are supported on platform version `1.4.0` or later -EC2 | Tasks hosted on Nitro-based instances with Amazon ECS-optimized Amazon Machine Images (AMIs). For more information about instance types, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the _Amazon EC2 User Guide_. Amazon EBS volumes are supported on ECS-optimized AMI `20231219` or later. For more information, see [Retrieving Amazon ECS-Optimized AMI metadata](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/retrieve-ecs-optimized_AMI.html). | Tasks hosted on Nitro-based instances with Amazon ECS-optimized Amazon Machine Images (AMIs). For more information about instance types, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the _Amazon EC2 User Guide_. Amazon EBS volumes are supported on ECS-optimized AMI `20241017` or later. For more information, see [Retrieving Amazon ECS-Optimized Windows AMI metadata](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/retrieve-ecs-optimized_windows_AMI.html). +EC2 | Amazon EBS volumes are supported for tasks hosted on Nitro-based instances with Amazon ECS-optimized Amazon Machine Images (AMIs). For more information about instance types, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the _Amazon EC2 User Guide_. Amazon EBS volumes are supported on ECS-optimized AMI `20231219` or later. For more information, see [Retrieving Amazon ECS-Optimized AMI metadata](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/retrieve-ecs-optimized_AMI.html). | Tasks hosted on Nitro-based instances with Amazon ECS-optimized Amazon Machine Images (AMIs). For more information about instance types, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the _Amazon EC2 User Guide_. Amazon EBS volumes are supported on ECS-optimized AMI `20241017` or later. For more information, see [Retrieving Amazon ECS-Optimized Windows AMI metadata](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/retrieve-ecs-optimized_windows_AMI.html). +Amazon ECS Managed Instances | Amazon EBS volumes are supported for tasks hosted on Amazon ECS Managed Instances on Linux. | Not supported @@ -36 +39 @@ Consider the following when using Amazon EBS volumes: - * You can't configure Amazon EBS volumes for attachment to Fargate launch type Amazon ECS tasks in the `us-east-1c` Availability Zone. + * You can't configure Amazon EBS volumes for attachment to Fargate Amazon ECS tasks in the `us-east-1c` Availability Zone. @@ -44 +47 @@ Consider the following when using Amazon EBS volumes: - * To use Amazon EBS volumes with Amazon ECS services, the deployment controller must be 'ECS'. Both rolling and blue/green deployment strategies are supported when using this deployment controller. + * To use Amazon EBS volumes with Amazon ECS services, the deployment controller must be `ECS`. Both rolling and blue/green deployment strategies are supported when using this deployment controller.