AWS AmazonECS documentation change
Summary
Added IPv6-only workload configuration guidance including VPC/subnet requirements, IPv6 address assignment instructions, and ECS_INSTANCE_IP_COMPATIBILITY parameter documentation
Security assessment
The changes document proper IPv6 network configuration practices but do not address a specific security vulnerability. The additions help prevent service disruptions (like load balancer registration failures) through correct network setup, which has indirect security benefits by ensuring intended network isolation.
Diff
diff --git a/AmazonECS/latest/developerguide/launch_container_instance.md b/AmazonECS/latest/developerguide/launch_container_instance.md index d9c27f68e..61c50c217 100644 --- a//AmazonECS/latest/developerguide/launch_container_instance.md +++ b//AmazonECS/latest/developerguide/launch_container_instance.md @@ -95 +95 @@ Alternatively, choose **Cancel** (at top right) to return to the launch instance -The instance type defines the hardware configuration and size of the instance. Larger instance types have more CPU and memory. For more information, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html). +The instance type defines the hardware configuration and size of the instance. Larger instance types have more CPU and memory. For more information, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the _Amazon EC2 User Guide_. If you want to run an IPv6-only workload, certain instance types don't support IPv6 addresses. For more information, see [IPv6 addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ipv6-addressing) in the _Amazon EC2 User Guide_. @@ -114 +114 @@ If you choose the **Proceed without key pair (Not recommended)** option, you won -Configure the network settings, as necessary. +Configure the network settings as necessary after choosing the **Edit** button for the **Network settings** section of the form. @@ -116 +116 @@ Configure the network settings, as necessary. - * **Networking platform** : Choose **Virtual Private Cloud (VPC)** , and then specify the subnet in the **Network interfaces** section. + * For **VPC** , choose the VPC that you want to launch the instance into. To run an IPv6-only workload, choose a dual stack VPC that includes both an IPv4 and an IPv6 CIDR block. @@ -118,3 +118 @@ Configure the network settings, as necessary. - * **VPC** : Select an existing VPC in which to create the security group. - - * **Subnet** : You can launch an instance in a subnet associated with an Availability Zone, Local Zone, Wavelength Zone, or Outpost. + * For **Subnet** , choose the subnet to launch the instance in. You can launch an instance in a subnet associated with an Availability Zone, Local Zone, Wavelength Zone, or Outpost. @@ -127,0 +126,2 @@ To launch an instance in an Outpost, select a subnet in a VPC that you associate +To run an IPv6-only workload, choose a subnet that includes only an IPv6 CIDR block. + @@ -137,0 +138,2 @@ If you do not have an interface VPC endpoint configured and your container insta + * If you choose a dual stack VPC and an IPv6-only subnet, for **Auto-assign IPv6 IP** , choose **Enable**. + @@ -141,0 +144,6 @@ If you do not have an interface VPC endpoint configured and your container insta + * If you are launching the instance for an IPv6-only workload, choose **Advanced network configuration** , and then for **Assign Primary IPv6 IP** , choose **Yes**. + +###### Note + +Without a primary IPv6 address, tasks running on the container instance in the host or bridge network modes will fail to register with load balancers or with AWS Cloud Map. + @@ -172,2 +179,0 @@ If you are using Spot Instances and see a `Not available` message, you may need -. - @@ -218,0 +225,8 @@ The following is an example of a user data script that would propagate the tags + * By default, the Amazon ECS container agent will try to detect the container instance's compatibility for an IPv6-only configuration by looking at the instance's default IPv4 and IPv6 routes. To override this behavior, you can set the ` ECS_INSTANCE_IP_COMPATIBILITY` parameter to `ipv4` or `ipv6` in the instance's `/etc/ecs/ecs.config` file. + + #!/bin/bash + cat <<'EOF' >> /etc/ecs/ecs.config + ECS_CLUSTER=your_cluster_name + ECS_INSTANCE_IP_COMPATIBILITY=ipv6 + EOF +