AWS cli medium security documentation change
Summary
Added support for managed instances provider configuration in capacity providers, including infrastructure IAM roles, launch templates, network security groups, storage, monitoring, and instance requirements. Updated CLI version reference and expanded provider type documentation.
Security assessment
The change introduces mandatory security configurations for managed instances, including infrastructure IAM roles (infrastructureRoleArn) with EC2 lifecycle permissions and instance profiles (ec2InstanceProfileArn) for task access control. It explicitly documents security group requirements for network traffic control and emphasizes IAM role permissions management. These are security-critical components for instance management and access control.
Diff
diff --git a/cli/latest/reference/ecs/create-capacity-provider.md b/cli/latest/reference/ecs/create-capacity-provider.md index dfbe53f54..4ea6fa90f 100644 --- a//cli/latest/reference/ecs/create-capacity-provider.md +++ b//cli/latest/reference/ecs/create-capacity-provider.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -60,3 +60 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Creates a new capacity provider. Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling. - -Only capacity providers that use an Auto Scaling group can be created. Amazon ECS tasks on Fargate use the `FARGATE` and `FARGATE_SPOT` capacity providers. These providers are available to all accounts in the Amazon Web Services Regions that Fargate supports. +Creates a capacity provider. Capacity providers are associated with a cluster and are used in capacity provider strategies to facilitate cluster auto scaling. You can create capacity providers for Amazon ECS Managed Instances and EC2 instances. Fargate has the predefined `FARGATE` and `FARGATE_SPOT` capacity providers. @@ -71 +69,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 - --auto-scaling-group-provider <value> + [--cluster <value>] + [--auto-scaling-group-provider <value>] + [--managed-instances-provider <value>] @@ -101 +101,5 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 -`--auto-scaling-group-provider` (structure) [required] +`--cluster` (string) + +> The name of the cluster to associate with the capacity provider. When you create a capacity provider with Amazon ECS Managed Instances, it becomes available only within the specified cluster. + +`--auto-scaling-group-provider` (structure) @@ -222,0 +227,451 @@ JSON Syntax: +`--managed-instances-provider` (structure) + +> The configuration for the Amazon ECS Managed Instances provider. This configuration specifies how Amazon ECS manages Amazon EC2 instances on your behalf, including the infrastructure role, instance launch template, and tag propagation settings. +> +> infrastructureRoleArn -> (string) [required] +> +>> The Amazon Resource Name (ARN) of the infrastructure role that Amazon ECS uses to manage instances on your behalf. This role must have permissions to launch, terminate, and manage Amazon EC2 instances, as well as access to other Amazon Web Services services required for Amazon ECS Managed Instances functionality. +>> +>> For more information, see [Amazon ECS infrastructure IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html) in the _Amazon ECS Developer Guide_ . +> +> instanceLaunchTemplate -> (structure) [required] +> +>> The launch template configuration that specifies how Amazon ECS should launch Amazon EC2 instances. This includes the instance profile, network configuration, storage settings, and instance requirements for attribute-based instance type selection. +>> +>> For more information, see [Store instance launch parameters in Amazon EC2 launch templates](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html) in the _Amazon EC2 User Guide_ . +>> +>> ec2InstanceProfileArn -> (string) [required] +>> +>>> The Amazon Resource Name (ARN) of the instance profile that Amazon ECS applies to Amazon ECS Managed Instances. This instance profile must include the necessary permissions for your tasks to access Amazon Web Services services and resources. +>>> +>>> For more information, see [Amazon ECS instance profile for Managed Instances](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/managed-instances-instance-profile.html) in the _Amazon ECS Developer Guide_ . +>> +>> networkConfiguration -> (structure) [required] +>> +>>> The network configuration for Amazon ECS Managed Instances. This specifies the subnets and security groups that instances use for network connectivity. +>>> +>>> subnets -> (list) +>>> +>>>> The list of subnet IDs where Amazon ECS can launch Amazon ECS Managed Instances. Instances are distributed across the specified subnets for high availability. All subnets must be in the same VPC. +>>>> +>>>> (string) +>>> +>>> securityGroups -> (list) +>>> +>>>> The list of security group IDs to apply to Amazon ECS Managed Instances. These security groups control the network traffic allowed to and from the instances. +>>>> +>>>> (string) +>> +>> storageConfiguration -> (structure) +>> +>>> The storage configuration for Amazon ECS Managed Instances. This defines the root volume size and type for the instances. +>>> +>>> storageSizeGiB -> (integer) +>>> +>>>> The size of the tasks volume. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> + +>> +>> monitoring -> (string) +>> +>>> CloudWatch provides two categories of monitoring: basic monitoring and detailed monitoring. By default, your managed instance is configured for basic monitoring. You can optionally enable detailed monitoring to help you more quickly identify and act on operational issues. You can enable or turn off detailed monitoring at launch or when the managed instance is running or stopped. For more information, see [Detailed monitoring for Amazon ECS Managed Instances](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/detailed-monitoring-managed-instances.html) in the Amazon ECS Developer Guide. +>>> +>>> Possible values: +>>> +>>> * `BASIC` +>>> * `DETAILED` +>>> + +>> +>> instanceRequirements -> (structure) +>> +>>> The instance requirements. You can specify: +>>> +>>> * The instance types +>>> * Instance requirements such as vCPU count, memory, network performance, and accelerator specifications +>>> + +>>> +>>> Amazon ECS automatically selects the instances that match the specified criteria. +>>> +>>> vCpuCount -> (structure) [required] +>>> +>>>> The minimum and maximum number of vCPUs for the instance types. Amazon ECS selects instance types that have vCPU counts within this range. +>>>> +>>>> min -> (integer) [required] +>>>> +>>>>> The minimum number of vCPUs. Instance types with fewer vCPUs than this value are excluded from selection. +>>>> +>>>> max -> (integer) +>>>> +>>>>> The maximum number of vCPUs. Instance types with more vCPUs than this value are excluded from selection. +>>> +>>> memoryMiB -> (structure) [required] +>>> +>>>> The minimum and maximum amount of memory in mebibytes (MiB) for the instance types. Amazon ECS selects instance types that have memory within this range. +>>>> +>>>> min -> (integer) [required] +>>>> +>>>>> The minimum amount of memory in MiB. Instance types with less memory than this value are excluded from selection. +>>>> +>>>> max -> (integer) +>>>> +>>>>> The maximum amount of memory in MiB. Instance types with more memory than this value are excluded from selection. +>>> +>>> cpuManufacturers -> (list) +>>> +>>>> The CPU manufacturers to include or exclude. You can specify `intel` , `amd` , or `amazon-web-services` to control which CPU types are used for your workloads. +>>>> +>>>> (string) +>>>> +>>>>> Possible values: +>>>>> +>>>>> * `intel` +>>>>> * `amd` +>>>>> * `amazon-web-services` +>>>>> + +>>> +>>> memoryGiBPerVCpu -> (structure) +>>> +>>>> The minimum and maximum amount of memory per vCPU in gibibytes (GiB). This helps ensure that instance types have the appropriate memory-to-CPU ratio for your workloads. +>>>> +>>>> min -> (double) +>>>> +>>>>> The minimum amount of memory per vCPU in GiB. Instance types with a lower memory-to-vCPU ratio are excluded from selection. +>>>> +>>>> max -> (double) +>>>> +>>>>> The maximum amount of memory per vCPU in GiB. Instance types with a higher memory-to-vCPU ratio are excluded from selection. +>>> +>>> excludedInstanceTypes -> (list) +>>> +>>>> The instance types to exclude from selection. Use this to prevent Amazon ECS from selecting specific instance types that may not be suitable for your workloads. +>>>> +>>>> Constraints: +>>>> +>>>> * max: `400` +>>>> + +>>>> +>>>> (string) +>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `30` +>>>>> * pattern: `[a-zA-Z0-9\.\*\-]+` +>>>>> + +>>> +>>> instanceGenerations -> (list) +>>> +>>>> The instance generations to include. You can specify `current` to use the latest generation instances, or `previous` to include previous generation instances for cost optimization. +>>>> +>>>> (string) +>>>> +>>>>> Possible values: +>>>>> +>>>>> * `current` +>>>>> * `previous` +>>>>> + +>>> +>>> spotMaxPricePercentageOverLowestPrice -> (integer) +>>> +>>>> The maximum price for Spot instances as a percentage over the lowest priced On-Demand instance. This helps control Spot instance costs while maintaining access to capacity. +>>> +>>> onDemandMaxPricePercentageOverLowestPrice -> (integer) +>>> +>>>> The price protection threshold for On-Demand Instances, as a percentage higher than an identified On-Demand price. The identified On-Demand price is the price of the lowest priced current generation C, M, or R instance type with your specified attributes. If no current generation C, M, or R instance type matches your attributes, then the identified price is from either the lowest priced current generation instance types or, failing that, the lowest priced previous generation instance types that match your attributes. When Amazon ECS selects instance types with your attributes, we will exclude instance types whose price exceeds your specified threshold. +>>> +>>> bareMetal -> (string) +>>> +>>>> Indicates whether to include bare metal instance types. Set to `included` to allow bare metal instances, `excluded` to exclude them, or `required` to use only bare metal instances. +>>>> +>>>> Possible values: +>>>> +>>>> * `included` +>>>> * `required` +>>>> * `excluded` +>>>>