AWS AmazonECS documentation change
Summary
Updated IAM policy examples with concrete ARN formats, corrected JSON syntax (e.g., Resource field formatting), added JSON section headers, and replaced placeholder values (e.g., <aws_account_id>) with example values like 123456789012.
Security assessment
Changes demonstrate security best practices by showing explicit resource ARNs (e.g., 'arn:aws:ecs:us-east-1:123456789012:cluster/cluster-name') instead of wildcards/placeholders, enforcing least-privilege principles. However, there is no evidence of addressing a specific disclosed vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.md b/AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.md index 6282b1a8f..c5b79149a 100644 --- a//AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.md +++ b//AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.md @@ -102,0 +103,6 @@ The following IAM policy allows permission to create and list clusters. The `Cre +JSON + + +**** + + @@ -105 +110,0 @@ The following IAM policy allows permission to create and list clusters. The `Cre - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -113 +118 @@ The following IAM policy allows permission to create and list clusters. The `Cre - "Resource": ["*"] + "Resource": "*" @@ -118 +123,6 @@ The following IAM policy allows permission to create and list clusters. The `Cre -The following IAM policy allows permission to describe and delete a specific cluster. The `DescribeClusters` and `DeleteCluster` actions accept cluster ARNs as resources. + +JSON + + +**** + @@ -122 +131,0 @@ The following IAM policy allows permission to describe and delete a specific clu - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -130 +139,52 @@ The following IAM policy allows permission to describe and delete a specific clu - "Resource": ["arn:aws:ecs:us-east-1:<aws_account_id>:cluster/<cluster_name>"] + "Resource": ["arn:aws:ecs:us-east-1:123456789012:cluster/cluster-name"] + } + ] + } + + +The following IAM policy allows permission to describe and delete a specific cluster. The `DescribeClusters` and `DeleteCluster` actions accept cluster ARNs as resources. + +JSON + + +**** + + + + { + "Statement": [ + { + "Action": [ + "ecs:Describe*", + "ecs:List*" + ], + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "ecs:DeleteCluster", + "ecs:DeregisterContainerInstance", + "ecs:ListContainerInstances", + "ecs:RegisterContainerInstance", + "ecs:SubmitContainerStateChange", + "ecs:SubmitTaskStateChange" + ], + "Effect": "Allow", + "Resource": "arn:aws:ecs:us-east-1:123456789012:cluster/default" + }, + { + "Action": [ + "ecs:DescribeContainerInstances", + "ecs:DescribeTasks", + "ecs:ListTasks", + "ecs:UpdateContainerAgent", + "ecs:StartTask", + "ecs:StopTask", + "ecs:RunTask" + ], + "Effect": "Allow", + "Resource": "*", + "Condition": { + "ArnEquals": {"ecs:cluster": "arn:aws:ecs:us-east-1:123456789012:cluster/default"} + } @@ -139 +200 @@ The following IAM policy can be attached to a user or group that would only allo - "Version": "2012-10-17",&TCX5-2025-waiver; + "Version": "2012-10-17", @@ -159 +220 @@ The following IAM policy can be attached to a user or group that would only allo - "Resource": "arn:aws:ecs:us-east-1:<aws_account_id>:cluster/default" + "Resource": "arn:aws:ecs:us-east-1:111122223333:cluster/default" @@ -174 +235 @@ The following IAM policy can be attached to a user or group that would only allo - "ArnEquals": {"ecs:cluster": "arn:aws:ecs:us-east-1:<aws_account_id>:cluster/default"} + "ArnEquals": {"ecs:cluster": "arn:aws:ecs:us-east-1:111122223333:cluster/default"} @@ -185,0 +247,6 @@ The following IAM policy allows a user to list and deregister container instance +JSON + + +**** + + @@ -188 +254,0 @@ The following IAM policy allows a user to list and deregister container instance - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -196 +262 @@ The following IAM policy allows a user to list and deregister container instance - "Resource": ["arn:aws:ecs:<region>:<aws_account_id>:cluster/<cluster_name>"] + "Resource": "arn:aws:ecs:us-east-1:123456789012:cluster/cluster_name" @@ -206,0 +274,6 @@ If you use the console, you must add `CloudFormation: CreateStack` as an `Action +JSON + + +**** + + @@ -209 +281,0 @@ If you use the console, you must add `CloudFormation: CreateStack` as an `Action - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -218 +290 @@ If you use the console, you must add `CloudFormation: CreateStack` as an `Action - "Resource": ["*"] + "Resource": "*" @@ -228,0 +302,6 @@ The following IAM policy allows permission to run any revision of a specific tas +JSON + + +**** + + @@ -231 +309,0 @@ The following IAM policy allows permission to run any revision of a specific tas - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -237 +315 @@ The following IAM policy allows permission to run any revision of a specific tas - "ArnEquals": {"ecs:cluster": "arn:aws:ecs:<region>:<aws_account_id>:cluster/<cluster_name>"} + "ArnEquals": {"ecs:cluster": "arn:aws:ecs:us-east-1:123456789012:cluster/cluster_name"} @@ -239 +317 @@ The following IAM policy allows permission to run any revision of a specific tas - "Resource": ["arn:aws:ecs:<region>:<aws_account_id>:task-definition/<task_family>:*"] + "Resource": ["arn:aws:ecs:us-east-1:123456789012:task-definition/task_family:*"] @@ -253,0 +333,6 @@ For this example, when you call the `StartTask` API with the AWS CLI or another +JSON + + +**** + + @@ -256 +340,0 @@ For this example, when you call the `StartTask` API with the AWS CLI or another - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -263,2 +347,2 @@ For this example, when you call the `StartTask` API with the AWS CLI or another - "ecs:cluster": "arn:aws:ecs:<region>:<aws_account_id>:cluster/<cluster_name>", - "ecs:container-instances": ["arn:aws:ecs:<region>:<aws_account_id>:container-instance/<cluster_name>/<container_instance_UUID>"] + "ecs:cluster": "arn:aws:ecs:us-east-1:123456789012:cluster/cluster_name", + "ecs:container-instances": ["arn:aws:ecs:us-east-1:123456789012:container-instance/cluster_name/container_instance_UUID"] @@ -267 +351 @@ For this example, when you call the `StartTask` API with the AWS CLI or another - "Resource": ["arn:aws:ecs:<region>:<aws_account_id>:task-definition/<task_family>:*"] + "Resource": ["arn:aws:ecs:us-east-1:123456789012:task-definition/task_family:*"] @@ -275,0 +361,6 @@ The following IAM policy allows a user to describe a specified task in a specifi +JSON + + +**** + + @@ -278 +368,0 @@ The following IAM policy allows a user to describe a specified task in a specifi - "Version": "2012-10-17",&TCX5-2025-waiver; @@ -284 +374 @@ The following IAM policy allows a user to describe a specified task in a specifi - "ArnEquals": {"ecs:cluster": "arn:aws:ecs:<region>:<aws_account_id>:cluster/<cluster_name>"} + "ArnEquals": {"ecs:cluster": "arn:aws:ecs:us-east-1:123456789012:cluster/cluster_name"} @@ -286 +376 @@ The following IAM policy allows a user to describe a specified task in a specifi - "Resource": ["arn:aws:ecs:<region>:<aws_account_id>:task/<cluster_name>/<task_UUID>"] + "Resource": ["arn:aws:ecs:us-east-1:123456789012:task/cluster_name/task_UUID"] @@ -294,0 +386,6 @@ The following IAM policy allows a user to create Amazon ECS services in the AWS +JSON + + +**** + + @@ -297 +394 @@ The following IAM policy allows a user to create Amazon ECS services in the AWS - "Version": "2012-10-17",&TCX5-2025-waiver; + "Version":"2012-10-17", @@ -319 +416 @@ The following IAM policy allows a user to create Amazon ECS services in the AWS - "Resource": ["*"] + "Resource": "*" @@ -362,0 +461,6 @@ The following IAM policy denies a user from overriding the default Service Conne +JSON + + +**** + + @@ -365 +469 @@ The following IAM policy denies a user from overriding the default Service Conne - "Version": "2012-10-17",&TCX5-2025-waiver; + "Version":"2012-10-17", @@ -375,2 +479,2 @@ The following IAM policy denies a user from overriding the default Service Conne - "ecs:cluster": "arn:aws:ecs:<region>:<aws_account_id>:cluster/<cluster_name>", - "ecs:namespace": "arn:aws:servicediscovery:<region>:<aws_account_id>:namespace/<namespace_id>" + "ecs:cluster": "arn:aws:ecs:us-east-1:123456789012:cluster/cluster_name", + "ecs:namespace": "arn:aws:servicediscovery:us-east-1:123456789012:namespace/namespace_id"