AWS AmazonECS documentation change
Summary
Added section about container image best practices and updated infrastructure type descriptions. Added guidance for choosing between ECS Managed Instances, Fargate, and EC2.
Security assessment
The change adds 'Container image best practices' section including security-relevant guidance like avoiding 'latest' tags and handling SIGTERM signals. While these are security best practices, there's no evidence this addresses a specific vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/ecs-configuration.md b/AmazonECS/latest/developerguide/ecs-configuration.md index a9796c31a..0ebb9a53d 100644 --- a//AmazonECS/latest/developerguide/ecs-configuration.md +++ b//AmazonECS/latest/developerguide/ecs-configuration.md @@ -5 +5 @@ -CapacityService endpointsNetworkingFeature accessIAM rolesLogging +CapacityService endpointsNetworkingFeature accessIAM rolesLoggingContainer image best practices @@ -9,5 +9 @@ CapacityService endpointsNetworkingFeature accessIAM rolesLogging -The following diagram shows the application lifecycle and how it works with the Amazon ECS components. - - - -You must architect your applications so that they can run on _containers_. A container is a standardized unit of software development that holds everything that your software application requires to run. This includes relevant code, runtime, system tools, and system libraries. Containers are created from a read-only template that's called an _image_. Images are typically built from a Dockerfile. A Dockerfile is a plaintext file that contains the instructions for building a container. After they're built, these images are stored in a _registry_ such as Amazon ECR where they can be downloaded from. +You must architect your applications so that they can run on _containers_. A container is a standardized unit of software development that holds everything that your software application requires to run. This includes relevant code, runtime, system tools, and system libraries. Containers are created from a read-only template that's called an _image_. A container image, is a static artifact containing your application and its dependencies. Images are typically built from a Dockerfile. A Dockerfile is a plaintext file that contains the instructions for building a container. After they're built, these images are stored in a _registry_ such as Amazon ECR where they can be downloaded from. @@ -34 +30,25 @@ After you deploy the task or service, you can use any of the following tools to -The capacity is the infrastructure where your containers run. The following are the options: +The capacity is the infrastructure where your containers run. Amazon ECS offers three infrastructure types for your clusters: + + * Amazon ECS Managed Instances - AWS fully manages the underlying Amazon EC2 instances running in your account, including provisioning, patching, and scaling. This option provides the optimal balance of performance, cost-effectiveness, and operational simplicity. + + * Serverless (Fargate) - Pay only for the resources your tasks use without managing any infrastructure. Ideal for variable workloads and getting started quickly. + + * Amazon EC2 instances - You manage the underlying Amazon EC2 instances directly, including instance selection, configuration, and maintenance. + + + + +Use Amazon ECS Managed Instances when: + + * You want the simplicity of Fargate with more control over the underlying infrastructure. + + * You need predictable performance and cost optimization. + + * You want AWS to handle infrastructure management while maintaining flexibility. + + + + +Use Fargate when: + + * You want to focus on your application without managing infrastructure. @@ -36 +56 @@ The capacity is the infrastructure where your containers run. The following are - * Amazon EC2 instances + * You have variable or unpredictable workloads. @@ -38 +58 @@ The capacity is the infrastructure where your containers run. The following are - * Serverless (AWS Fargate) + * You're getting started with containers and want the simplest deployment option. @@ -40 +59,0 @@ The capacity is the infrastructure where your containers run. The following are - * On-premises virtual machines (VM) or servers @@ -43,0 +63 @@ The capacity is the infrastructure where your containers run. The following are +Use Amazon EC2 instances when: @@ -45 +65,10 @@ The capacity is the infrastructure where your containers run. The following are -You specify the infrastructure when you create a cluster. You also specify the infrastructure type when you register a task definition. The task definition refers to the infrastructure as the "launch type". You also use the launch type when you run a standalone task or deploy a service. For information about the launch type options, see [Amazon ECS launch types](./launch_types.html). + * You need specialized hardware requirements (GPU acceleration, high-performance computing). + + * You require capacity reservations or specific instance types. + + * You need privileged capabilities or custom AMIs. + + + + +You specify the infrastructure when you create a cluster. You also specify the infrastructure type when you register a task definition. The task definition refers to the infrastructure as the "launch type". You can also use capacity providers. @@ -142,0 +172,17 @@ Logging and monitoring are important aspects of maintaining the reliability, ava +## Container image best practices + +The following are key principles for Amazon ECS container images: + + * Include all dependencies in the image + + * Run one process per container + + * Handle `SIGTERM` for graceful shutdowns + + * Write logs to `stdout` and `stderr` + + * Use unique tags, avoid `latest` in production + + + + @@ -149 +195 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -AWS Fargate Regions +Best practices @@ -151 +197 @@ AWS Fargate Regions -Launch types +Using dual-stack endpoints