AWS AmazonECS documentation change
Summary
Updated section headers and added IPv6-only configuration considerations for ECR dualstack image URIs with VPC endpoints
Security assessment
The change adds documentation about VPC endpoint limitations for IPv6-only configurations, which helps users avoid misconfigurations that could lead to unintended network exposure. While it clarifies security-related infrastructure constraints, there is no direct evidence of addressing a specific vulnerability.
Diff
diff --git a/AmazonECS/latest/developerguide/vpc-endpoints.md b/AmazonECS/latest/developerguide/vpc-endpoints.md index 8e57e58d1..c9c200216 100644 --- a//AmazonECS/latest/developerguide/vpc-endpoints.md +++ b//AmazonECS/latest/developerguide/vpc-endpoints.md @@ -53 +53 @@ The copied-from Region contains Region-specific VPC endpoints. | -### Considerations for Amazon ECS VPC endpoints for the Fargate launch type +### Considerations for Amazon ECS VPC endpoints for Fargate @@ -59 +59 @@ Before you set up interface VPC endpoints for Amazon ECS, be aware of the follow - * Tasks using the Fargate launch type don't require the interface VPC endpoints for Amazon ECS, but you might need interface VPC endpoints for Amazon ECR, Secrets Manager, or Amazon CloudWatch Logs described in the following points. + * Tasks using Fargate don't require the interface VPC endpoints for Amazon ECS, but you might need interface VPC endpoints for Amazon ECR, Secrets Manager, or Amazon CloudWatch Logs described in the following points. @@ -65 +65,3 @@ Before you set up interface VPC endpoints for Amazon ECS, be aware of the follow -If you configure Amazon ECR to use an interface VPC endpoint, you can create a task execution role that includes condition keys to restrict access to a specific VPC or VPC endpoint. For more information, see [Fargate tasks pulling Amazon ECR images over interface endpoints permissions](./task_execution_IAM_role.html#task-execution-ecr-conditionkeys). + * If you configure Amazon ECR to use an interface VPC endpoint, you can create a task execution role that includes condition keys to restrict access to a specific VPC or VPC endpoint. For more information, see [Fargate tasks pulling Amazon ECR images over interface endpoints permissions](./task_execution_IAM_role.html#task-execution-ecr-conditionkeys). + + * If your tasks are in an IPv6-only configuration and use an Amazon ECR dualstack image URI, note that Amazon ECR doesn't support dualstack interface VPC endpoints. For more information, see [Getting started with making requests over IPv6](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-requests.html#ipv6-access-getting-started) in the _Amazon Elastic Container Registry User Guide_. @@ -82 +84 @@ If you configure Amazon ECR to use an interface VPC endpoint, you can create a t -### Considerations for Amazon ECS VPC endpoints for the EC2 launch type +### Considerations for Amazon ECS VPC endpoints for EC2 @@ -86 +88 @@ Before you set up interface VPC endpoints for Amazon ECS, be aware of the follow - * Tasks using the EC2 launch type require that the container instances that they're launched on to run version `1.25.1` or later of the Amazon ECS container agent. For more information, see [Amazon ECS Linux container instance management](./manage-linux.html). + * Tasks using EC2 require that the container instances that they're launched on to run version `1.25.1` or later of the Amazon ECS container agent. For more information, see [Amazon ECS Linux container instance management](./manage-linux.html).