AWS AmazonECS documentation change
Summary
Added documentation for three new IAM policies: AmazonECSInfrastructureRolePolicyForManagedInstances, AmazonECSComputeServiceRolePolicy, and AmazonECSInstanceRolePolicyForManagedInstances, detailing their permissions for EC2 instance management in ECS
Security assessment
The changes document new IAM policies that control permissions for EC2 resource management and instance lifecycle operations. While these are security-related permissions, there is no evidence of addressing a specific vulnerability or incident - this appears to be routine documentation of new security features/controls.
Diff
diff --git a/AmazonECS/latest/developerguide/security-iam-awsmanpol.md b/AmazonECS/latest/developerguide/security-iam-awsmanpol.md index e61a3f375..2ed9b6768 100644 --- a//AmazonECS/latest/developerguide/security-iam-awsmanpol.md +++ b//AmazonECS/latest/developerguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AmazonECS_FullAccessAmazonECSInfrastructureRolePolicyForVolumesAmazonEC2ContainerServiceforEC2RoleAmazonEC2ContainerServiceEventsRoleAmazonECSTaskExecutionRolePolicyAmazonECSServiceRolePolicyAmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurityAWSApplicationAutoscalingECSServicePolicyAWSCodeDeployRoleForECSAWSCodeDeployRoleForECSLimitedAmazonECSInfrastructureRolePolicyForLoadBalancersAmazonECSInfrastructureRolePolicyForVpcLatticePolicy updates +AmazonECS_FullAccessAmazonECSInfrastructureRolePolicyForVolumesAmazonEC2ContainerServiceforEC2RoleAmazonEC2ContainerServiceEventsRoleAmazonECSTaskExecutionRolePolicyAmazonECSServiceRolePolicyAmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurityAWSApplicationAutoscalingECSServicePolicyAWSCodeDeployRoleForECSAWSCodeDeployRoleForECSLimitedAmazonECSInfrastructureRolePolicyForLoadBalancersAmazonECSInfrastructureRolePolicyForManagedInstancesAmazonECSInfrastructureRolePolicyForVpcLattice AmazonECSComputeServiceRolePolicyAmazonECSInstanceRolePolicyForManagedInstancesPolicy updates @@ -124,0 +125,23 @@ To view the permissions for this policy, see [AmazonECSInfrastructureRolePolicyF +## `AmazonECSInfrastructureRolePolicyForManagedInstances` + +You can attach the `AmazonECSInfrastructureRolePolicyForManagedInstances` policy to your IAM entities. This policy grants the permissions required by Amazon ECS to create and update Amazon EC2 resources for ECS Managed Instances on your behalf. The policy includes: + + * Permissions to create and manage Amazon EC2 launch templates for managed instances + + * Permissions to provision Amazon EC2 instances using CreateFleet and RunInstances + + * Permissions to create and manage tags on Amazon EC2 resources created by ECS + + * Permissions to pass IAM roles to Amazon EC2 instances for managed instances + + * Permissions to create service-linked roles for Amazon EC2 Spot instances + + * Read-only permissions to describe Amazon EC2 resources including instances, instance types, launch templates, network interfaces, availability zones, security groups, subnets, and VPCs + + + + +These permissions enable Amazon ECS to automatically provision and manage Amazon EC2 instances for your ECS Managed Instances, ensuring proper configuration and lifecycle management of the underlying compute resources. + +To view the permissions for this policy, see [AmazonECSInfrastructureRolePolicyForManagedInstances](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInfrastructureRolePolicyForManagedInstances.html) in the _AWS Managed Policy Reference_. + @@ -132,0 +156,46 @@ Provides access to other AWS service resources required to manage VPC Lattice fe +## ` AmazonECSComputeServiceRolePolicy` + +The `AmazonECSComputeServiceRolePolicy` policy is attached to the AmazonECSComputeServiceRole service-linked role. For more information, see [Using roles to manage Amazon ECS Managed Instances](./using-service-linked-roles-instances.html). + +This policy includes permissions that allow Amazon ECS to complete the following tasks: + + * Amazon ECS can describe and delete launch templates. + + * Amazon ECS can describe and delete launch template versions. + + * Amazon ECS can terminate instances. + + * Amazon ECS can describe the following instance data parameters: + + * Instance + + * Instance network interfaces: Amazon ECS can describe the the to manage the EC2 instance lifecycle. + + * Instance event window: Amazon ECS can describe the event window information in order to determine if the workflow can be interrupted for patching the instance. + + * Instance status: Amazon ECS can describe the instance status in order to monitor the instance health. + + + + +To view the permissions for this policy, see [ AmazonECSComputeServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSComputeServiceRolePolicy.html) in the _AWS Managed Policy Reference_. + +## `AmazonECSInstanceRolePolicyForManagedInstances` + +The `AmazonECSInstanceRolePolicyForManagedInstances` policy provides permissions for Amazon ECS managed instances to register with Amazon ECS clusters and communicate with the Amazon ECS service. + +This policy includes permissions that allow Amazon ECS managed instances to complete the following tasks: + + * Register and deregister with Amazon ECS clusters. + + * Submit container instance state changes. + + * Submit task state changes. + + * Discover polling endpoints for the Amazon ECS agent. + + + + +To view the permissions for this policy, see [AmazonECSInstanceRolePolicyForManagedInstances](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInstanceRolePolicyForManagedInstances.html) in the _AWS Managed Policy Reference_. + @@ -138,0 +208,3 @@ Change | Description | Date +Add new AmazonECSInstanceRolePolicyForManagedInstances | Added new AmazonECSInstanceRolePolicyForManagedInstances policy that provides permissions for Amazon ECS managed instances to register with Amazon ECS clusters. | September 30, 2025 +Add new AmazonECSInfrastructureRolePolicyForManagedInstances | Added new AmazonECSInfrastructureRolePolicyForManagedInstances policy that provides Amazon ECS access to create and manage Amazon EC2 managed resources. | September, 30, 2025 +Add new [AmazonECSComputeServiceRolePolicy](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonECSComputeServiceRolePolicy) | Allows Amazon ECS to manage your Amazon ECS Managed Instances and related resources. | August 31, 2025