AWS AmazonECS documentation change
Summary
Added detailed documentation about managed instance draining behavior including termination paths, graceful migration strategies, two-phase completion, and cross-service coordination
Security assessment
The changes document infrastructure refresh termination to maintain security posture through instance rotation, but there's no evidence of addressing a specific vulnerability. The security-related aspect is the mention of maintaining security posture through periodic instance refresh with TTL policies.
Diff
diff --git a/AmazonECS/latest/developerguide/managed-instance-draining.md b/AmazonECS/latest/developerguide/managed-instance-draining.md index eef1c1fcb..b48178656 100644 --- a//AmazonECS/latest/developerguide/managed-instance-draining.md +++ b//AmazonECS/latest/developerguide/managed-instance-draining.md @@ -5 +5 @@ -How managed instance draining works with EventBridgeManaged instance draining Troubleshooting +How managed instance draining works with EventBridgeManaged instance draining TroubleshootingDraining behavior for Amazon ECS Managed Instances @@ -85,0 +86,59 @@ If your instances aren't terminating even after reaching and exceeding the maxim +## Draining behavior for Amazon ECS Managed Instances + +Amazon ECS Managed Instances implement sophisticated draining and termination processes that ensure graceful workload transitions while optimizing costs and maintaining system health. The termination system provides three distinct decision paths for instance termination, each with different timing characteristics and customer impact profiles. + +### Termination decision paths + +All termination paths converge on the same execution mechanism through the POST_DEREGISTER lifecycle hook that triggers Node Manager's ReleaseNode API for immediate Amazon EC2 instance termination. + +Customer-initiated termination + + +Provides direct control over instance removal when you need to remove container instances from service immediately. You invoke the DeregisterContainerInstance API with the force flag set to true, indicating that immediate termination is required despite any running workloads. + +System-initiated idle termination + + +Implements cost optimization through intelligent idle detection that identifies instances no longer serving workloads. The Elastic Workload Service (EWS) implements sophisticated idle detection algorithms that monitor instance utilization and initiate termination for instances that remain idle for configurable periods. + +Infrastructure refresh termination + + +Implements proactive infrastructure management through Node Manager's natural decay policy, where instances are periodically refreshed to ensure they run on the latest platform versions and maintain security posture. Node Manager implements time-to-live (TTL) policies that initiate graceful termination for instances that have reached their maximum operational lifetime. + +### Graceful draining and workload migration + +The graceful draining system implements sophisticated coordination with Amazon ECS service management to ensure that service-managed tasks are properly migrated away from instances scheduled for termination. + +###### Service task draining coordination + +When an instance transitions to DRAINING state, the Amazon ECS scheduler automatically stops placing new tasks on the instance while implementing graceful shutdown procedures for existing service tasks. The service task draining includes coordination with service deployment strategies, health check requirements, and your draining preferences to ensure optimal migration timing and success rates. + +###### Standalone task handling + +Standalone tasks require different handling because they do not benefit from automatic service management. The system evaluates standalone task characteristics including task duration estimates, completion probability analysis, and customer impact assessment. The graceful completion strategy allows standalone tasks to complete naturally during an extended grace period, while forced termination ensures infrastructure refresh occurs within acceptable timeframes when tasks have not completed naturally. + +### Two-phase completion strategy + +The termination system implements a two-phase approach that balances workload continuity against infrastructure management requirements. + +###### Phase 1: Graceful completion period + +During this phase, the system implements graceful draining strategies that prioritize workload continuity. Service tasks are gracefully drained through normal Amazon ECS scheduling processes, standalone tasks continue running and may complete naturally, and the system monitors for all tasks to reach stopped state through natural completion processes. + +###### Phase 2: Hard deadline enforcement + +When graceful completion does not achieve termination objectives within acceptable timeframes, the system implements hard deadline enforcement. The hard deadline is typically set to draining initiation time plus seven days, providing substantial time for graceful completion while maintaining operational requirements. The enforcement includes automatic invocation of force deregistration procedures and immediate termination of all remaining tasks regardless of completion status. + +### Cross-service coordination and state management + +The termination process requires sophisticated coordination between the Cluster Management Backend Service (CMBS) and Node Manager to ensure that container instance deregistration and Amazon EC2 resource cleanup occur in the proper sequence while maintaining consistency. + +###### POST_DEREGISTER hook execution + +The POST_DEREGISTER lifecycle hook represents the convergence point where all three termination decision paths execute the same cleanup logic. When a container instance reaches DEREGISTERED state, the POST_DEREGISTER hook automatically triggers Node Manager's ReleaseNode API to begin Amazon EC2 resource cleanup operations. The hook implementation includes sophisticated error handling for various failure scenarios including network connectivity issues, Amazon EC2 service availability problems, and coordination failures between system components. + +###### Amazon EC2 resource cleanup and deallocation + +The Amazon EC2 instance termination process implements comprehensive coordination with AWS services to ensure that underlying compute resources are properly deallocated. This includes network interface cleanup to prevent resource leaks, database record management with comprehensive audit trails, and appropriate error handling and recovery mechanisms for various failure scenarios. +