AWS AmazonECS documentation change
Summary
Added documentation for IPv6-only VPC mode support in Fargate, including configuration requirements, limitations, and supported regions
Security assessment
The changes document IPv6-only networking capabilities which is a security-relevant feature (network configuration), but there is no evidence of addressing a specific vulnerability. The note about ECR lacking dualstack VPC endpoints for IPv6 tasks highlights a limitation but doesn't indicate an active security issue.
Diff
diff --git a/AmazonECS/latest/developerguide/fargate-task-networking.md b/AmazonECS/latest/developerguide/fargate-task-networking.md index 255b9a75a..5ced4625e 100644 --- a//AmazonECS/latest/developerguide/fargate-task-networking.md +++ b//AmazonECS/latest/developerguide/fargate-task-networking.md @@ -5 +5 @@ -ConsiderationsUsing a VPC in dual-stack mode +ConsiderationsUsing a VPC in dual-stack modeUsing a VPC in IPv6-only mode @@ -7 +7 @@ ConsiderationsUsing a VPC in dual-stack mode -# Amazon ECS task networking options for the Fargate launch type +# Amazon ECS task networking options for Fargate @@ -56 +56 @@ Consider the following when using task networking. - * The following applies to tasks run on Fargate platform version `1.4.0` or later for Linux or `1.0.0` for Windows. Tasks launched in dual-stack subnets receive an IPv4 address and an IPv6 address. + * The following applies to tasks run on Fargate platform version `1.4.0` or later for Linux or `1.0.0` for Windows. Tasks launched in dual-stack subnets receive an IPv4 address and an IPv6 address. Tasks launched in IPv6-only subnets receive only an IPv6 address. @@ -60 +60 @@ Consider the following when using task networking. - * Services with tasks that use the Fargate launch type only support Application Load Balancer and Network Load Balancer. Classic Load Balancer isn't supported. When you create any target groups, you must choose `ip` as the target type, not `instance`. For more information, see [Use load balancing to distribute Amazon ECS service traffic](./service-load-balancing.html). + * Services with tasks that use Fargate only support Application Load Balancer and Network Load Balancer. Classic Load Balancer isn't supported. When you create any target groups, you must choose `ip` as the target type, not `instance`. For more information, see [Use load balancing to distribute Amazon ECS service traffic](./service-load-balancing.html). @@ -83,0 +84,98 @@ If you configure your VPC with an internet gateway or an outbound-only internet +## Using a VPC in IPv6-only mode + +In an IPv6-only configuration, your Amazon ECS tasks communicate exclusively over IPv6. To set up VPCs and subnets for an IPv6-only configuration, you must add an IPv6 CIDR block to the VPC and create subnets that include only an IPv6 CIDR block. For more information see [Add IPv6 support for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6-add.html) and [Create a subnet](https://docs.aws.amazon.com/vpc/latest/userguide/create-subnets.html) in the _Amazon VPC User Guide_. You must also update route tables with IPv6 targets and configure security groups with IPv6 rules. For more information, see [Configure route tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html) and [Configure security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-security-group-rules.html) in the _Amazon VPC User Guide_. + +The following considerations apply: + + * You can update an IPv4-only or dualstack Amazon ECS service to an IPv6-only configuration by either updating the service directly to use IPv6-only subnets or by creating a parallel IPv6-only service and using Amazon ECS blue-green deployments to shift traffic to the new service. For more information about Amazon ECS blue-green deployments, see [Amazon ECS blue/green deployments](./deployment-type-blue-green.html). + + * An IPv6-only Amazon ECS service must use dualstack load balancers with IPv6 target groups. If you're migrating an existing Amazon ECS service that's behind a Application Load Balancer or a Network Load Balancer, you can create a new dualstack load balancer and shift traffic from the old load balancer, or update the IP address type of the existing load balancer. + +For more information about Network Load Balancers, see [Create a Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-network-load-balancer.html) and [Update the IP address types for your Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-ip-address-type.html) in the _User Guide for Network Load Balancers_. For more information about Application Load Balancers, see [Create an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html) and [Update the IP address types for your Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-ip-address-type.html) in the _User Guide for Application Load Balancers_. + + * IPv6-only configuration isn't supported on Windows. + + * For Amazon ECS tasks in an IPv6-only configuration to communicate with IPv4-only endpoints, you can set up DNS64 and NAT64 for network address translation from IPv6 to IPv4. For more information, see [DNS64 and NAT64](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html) in the _Amazon VPC User Guide_. + + * IPv6-only configuration is supported on Fargate platform version `1.4.0` or later. + + * AAmazon ECS workloads in an IPv6-only configuration must use Amazon ECR dualstack image URI endpoints when pulling images from Amazon ECR. For more information, see [Getting started with making requests over IPv6](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-requests.html#ipv6-access-getting-started) in the _Amazon Elastic Container Registry User Guide_. + +###### Note + +Amazon ECR doesn't support dualstack interface VPC endpoints that tasks in an IPv6-only configuration can use. For more information, see [Getting started with making requests over IPv6](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-requests.html#ipv6-access-getting-started) in the _Amazon Elastic Container Registry User Guide_. + + * Amazon ECS Exec isn't supported in an IPv6-only configuration. + + * Amazon CloudWatch doesn't support a dualstack FIPS endpoint that can be used to monitor Amazon ECS tasks in IPv6-only configuration that use FIPS-140 compliance. For more information about FIPS-140, see [AWS Fargate Federal Information Processing Standard (FIPS-140)](./ecs-fips-compliance.html). + + + + +### AWS Regions that support IPv6-only mode for Amazon ECS + +You can run tasks in an IPv6-only configuration in the following AWS Regions that Amazon ECS is available in: + + * US East (Ohio) + + * US East (N. Virginia) + + * US West (N. California) + + * US West (Oregon) + + * Africa (Cape Town) + + * Asia Pacific (Hong Kong) + + * Asia Pacific (Hyderabad) + + * Asia Pacific (Jakarta) + + * Asia Pacific (Melbourne) + + * Asia Pacific (Mumbai) + + * Asia Pacific (Osaka) + + * Asia Pacific (Seoul) + + * Asia Pacific (Singapore) + + * Asia Pacific (Sydney) + + * Asia Pacific (Tokyo) + + * Canada (Central) + + * Canada West (Calgary) + + * China (Beijing) + + * China (Ningxia) + + * Europe (Frankfurt) + + * Europe (London) + + * Europe (Milan) + + * Europe (Paris) + + * Europe (Spain) + + * Israel (Tel Aviv) + + * Middle East (Bahrain) + + * Middle East (UAE) + + * South America (São Paulo) + + * AWS GovCloud (US-East) + + * AWS GovCloud (US-West) + + + +