AWS AmazonECS medium security documentation change
Summary
Added documentation for new managed IAM policies (Volumes, ServiceConnect TLS, VPC Lattice, Managed Instances) and updated CloudTrail monitoring details
Security assessment
Introduces new IAM policies related to security features like TLS encryption (ServiceConnectTransportLayerSecurity) and VPC Lattice networking. Updates CloudTrail monitoring for managed instances, which helps with security auditing. Directly documents security controls for infrastructure roles.
Diff
diff --git a/AmazonECS/latest/developerguide/infrastructure_IAM_role.md b/AmazonECS/latest/developerguide/infrastructure_IAM_role.md index 050d47ef3..dd591d108 100644 --- a//AmazonECS/latest/developerguide/infrastructure_IAM_role.md +++ b//AmazonECS/latest/developerguide/infrastructure_IAM_role.md @@ -12,0 +13,2 @@ An Amazon ECS infrastructure IAM role allows Amazon ECS to manage infrastructure +You can use the `AmazonECSInfrastructureRolePolicyForVolumes` managed policy. + @@ -14,0 +17,2 @@ An Amazon ECS infrastructure IAM role allows Amazon ECS to manage infrastructure +You can use the `AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity` managed policy. + @@ -16,0 +21,5 @@ An Amazon ECS infrastructure IAM role allows Amazon ECS to manage infrastructure +You can use the `AmazonECSInfrastructureRolePolicyForVpcLattice` managed policy. + + * You want to use Amazon ECS Managed Instances in your Amazon ECS clusters. The infrastructure role allows Amazon ECS to manage the lifecycle of managed instances. + +You can use the `AmazonECSInfrastructureRolePolicyForManagedInstances` managed policy. @@ -20 +28,0 @@ An Amazon ECS infrastructure IAM role allows Amazon ECS to manage infrastructure -When Amazon ECS assumes this role to take actions on your behalf, the events will be visible in AWS CloudTrail. If Amazon ECS uses the role to manage Amazon EBS volumes attached to your tasks, the CloudTrail log `roleSessionName` will be `ECSTaskVolumesForEBS`. If the role is used to encrypt traffic between your Service Connect services, the CloudTrail log `roleSessionName` will be `ECSServiceConnectForTLS`. If the role is used to create target groups for VPC Lattice, the CloudTrail log `roleSessionName` will be `ECSNetworkingWithVPCLattice`. You can use this name to search events in the CloudTrail console by filtering for **User name**. @@ -22 +30,3 @@ When Amazon ECS assumes this role to take actions on your behalf, the events wil -Amazon ECS provides managed policies which contain the permissions required for volume attachment and TLS. For more information see, [AmazonECSInfrastructureRolePolicyForVolumes](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForVolumes.html), [AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity.html), and [AmazonECSInfrastructureRolePolicyForVpcLattice](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForVpcLattice.html)in the _AWS Managed Policy Reference Guide_. +When Amazon ECS assumes this role to take actions on your behalf, the events will be visible in AWS CloudTrail. If Amazon ECS uses the role to manage Amazon EBS volumes attached to your tasks, the CloudTrail log `roleSessionName` will be `ECSTaskVolumesForEBS`. If the role is used to encrypt traffic between your Service Connect services, the CloudTrail log `roleSessionName` will be `ECSServiceConnectForTLS`. If the role is used to create target groups for VPC Lattice, the CloudTrail log `roleSessionName` will be `ECSNetworkingWithVPCLattice`. If the role is used to manage Amazon ECS Managed Instances, the CloudTrail log `roleSessionName` will be `ECSManagedInstancesForCompute`. You can use this name to search events in the CloudTrail console by filtering for **User name**. + +Amazon ECS provides managed policies which contain the permissions required for volume attachment, TLS, VPC Lattice, and managed instances. For more information see, [AmazonECSInfrastructureRolePolicyForVolumes](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForVolumes.html), [AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity.html), [AmazonECSInfrastructureRolePolicyForVpcLattice](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForVpcLattice.html), and [AmazonECSInfrastructureRolePolicyForManagedInstances](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForManagedInstances.html) in the _AWS Managed Policy Reference Guide_. @@ -57 +67 @@ JSON - 3. Depending on your use case, attach the AWS managed `AmazonECSInfrastructureRolePolicyForVolumes`, `AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity`, or `AmazonECSInfrastructureRolePolicyForVpcLattice` policy to the `ecsInfrastructureRole` role. + 3. Depending on your use case, attach the AWS managed `AmazonECSInfrastructureRolePolicyForVolumes`, `AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity`, `AmazonECSInfrastructureRolePolicyForVpcLattice`, or `AmazonECSInfrastructureRolePolicyForManagedInstances` policy to the `ecsInfrastructureRole` role. @@ -66,0 +77,4 @@ JSON + aws iam attach-role-policy \ + --role-name ecsInfrastructureRole \ + --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSInfrastructureRolePolicyForManagedInstances + @@ -74 +88 @@ You can also use the IAM console's **Custom trust policy** workflow to create th -If the ECS infrastructure role is being used by Amazon ECS to manage Amazon EBS volumes attached to your tasks, ensure the following before you stop tasks that use Amazon EBS volumes. +If the infrastructure role is being used by Amazon ECS to manage Amazon EBS volumes attached to your tasks, ensure the following before you stop tasks that use Amazon EBS volumes. @@ -126 +140 @@ Amazon ECS Anywhere IAM role -Infrastructure IAM role for load balancers +Amazon ECS Managed Instances instance profile