AWS AmazonECS medium security documentation change
Summary
Added documentation for accessing EC2 instance metadata via IPv6 IMDS endpoint and noted incompatibility with awsvpcTrunking
Security assessment
The change introduces IPv6 IMDS endpoint configuration guidance and explicitly warns about security implications when using awsvpcTrunking. It recommends using task IAM roles instead of instance roles in this scenario, which is a security best practice for credential management. The documentation addresses secure access methods and credential management patterns.
Diff
diff --git a/AmazonECS/latest/developerguide/ec2-metadata.md b/AmazonECS/latest/developerguide/ec2-metadata.md index efc6c59d6..fe40d55d0 100644 --- a//AmazonECS/latest/developerguide/ec2-metadata.md +++ b//AmazonECS/latest/developerguide/ec2-metadata.md @@ -22,0 +23,11 @@ If your Amazon ECS task is hosted on Amazon EC2, you can also access task host m +If your Amazon ECS task is hosted on Amazon EC2 and in an IPv6-only configuration, you can access task host metadata using the IPv6 IMDS endpoint. The following command, when run from within the instance hosting the task, lists the ID of the host instance over IPv6. + + + curl http://[fd00:ec2::254]/latest/meta-data/instance-id + +To access the IPv6 IMDS endpoint, enable the IPv6 IMDS endpoint on your container instance and also configure the metadata service endpoint mode using the IMDS credential provider for your chosen SDK to `IPv6`. For more information about enabling the IPv6 IMDS endpoint for your container instance, see [Configure the Instance Metadata Service options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html) in _Amazon EC2 User Guide_. For more information about IMDS credential provider for SDKs, see [IMDS credential provider](https://docs.aws.amazon.com/sdkref/latest/guide/feature-imds-credentials.html) in the _AWS SDKs and Tools Reference Guide_. + +###### Note + +The IPv6 IMDS endpoint is not accessible when the `awsvpcTrunking` account setting is enabled. To access container instance IAM role credentials when `awsvpcTrunking` is enabled, you can use a task IAM role instead. For more information about task IAM roles, see [Amazon ECS task IAM role](./task-iam-roles.html). + @@ -31 +42 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Container metadata file format +Task metadata v4 examples for tasks on Amazon ECS Managed Instances