AWS cli medium security documentation change
Summary
Added detailed configuration parameters for Managed Instances Provider including infrastructure IAM roles, security groups, instance requirements, and monitoring settings. Updated CLI version reference from 2.31.3 to 2.31.5.
Security assessment
The change introduces security-related parameters including required infrastructure IAM roles with specific permissions, security group configurations controlling network traffic, and instance profile requirements. These directly impact access control and network security for new EC2 instances managed by ECS. The documentation explicitly states requirements for IAM roles and security groups which are security constructs.
Diff
diff --git a/cli/latest/reference/ecs/update-capacity-provider.md b/cli/latest/reference/ecs/update-capacity-provider.md index f111a2dc9..1c321a54f 100644 --- a//cli/latest/reference/ecs/update-capacity-provider.md +++ b//cli/latest/reference/ecs/update-capacity-provider.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -60,0 +61,2 @@ Modifies the parameters for a capacity provider. +These changes only apply to new Amazon ECS Managed Instances, or EC2 instances, not existing ones. + @@ -68 +70,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 - --auto-scaling-group-provider <value> + [--cluster <value>] + [--auto-scaling-group-provider <value>] + [--managed-instances-provider <value>] @@ -97 +101,5 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/ecs-20 -`--auto-scaling-group-provider` (structure) [required] +`--cluster` (string) + +> The name of the cluster that contains the capacity provider to update. Managed instances capacity providers are cluster-scoped and can only be updated within their associated cluster. + +`--auto-scaling-group-provider` (structure) @@ -213,0 +222,442 @@ JSON Syntax: +`--managed-instances-provider` (structure) + +> The updated configuration for the Amazon ECS Managed Instances provider. You can modify the infrastructure role, instance launch template, and tag propagation settings. Changes take effect for new instances launched after the update. +> +> infrastructureRoleArn -> (string) [required] +> +>> The updated Amazon Resource Name (ARN) of the infrastructure role. The new role must have the necessary permissions to manage instances and access required Amazon Web Services services. +>> +>> For more information, see [Amazon ECS infrastructure IAM role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure_IAM_role.html) in the _Amazon ECS Developer Guide_ . +> +> instanceLaunchTemplate -> (structure) [required] +> +>> The updated launch template configuration. Changes to the launch template affect new instances launched after the update, while existing instances continue to use their original configuration. +>> +>> ec2InstanceProfileArn -> (string) +>> +>>> The updated Amazon Resource Name (ARN) of the instance profile. The new instance profile must have the necessary permissions for your tasks. +>>> +>>> For more information, see [Amazon ECS instance profile for Managed Instances](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/managed-instances-instance-profile.html) in the _Amazon ECS Developer Guide_ . +>> +>> networkConfiguration -> (structure) +>> +>>> The updated network configuration for Amazon ECS Managed Instances. Changes to subnets and security groups affect new instances launched after the update. +>>> +>>> subnets -> (list) +>>> +>>>> The list of subnet IDs where Amazon ECS can launch Amazon ECS Managed Instances. Instances are distributed across the specified subnets for high availability. All subnets must be in the same VPC. +>>>> +>>>> (string) +>>> +>>> securityGroups -> (list) +>>> +>>>> The list of security group IDs to apply to Amazon ECS Managed Instances. These security groups control the network traffic allowed to and from the instances. +>>>> +>>>> (string) +>> +>> storageConfiguration -> (structure) +>> +>>> The updated storage configuration for Amazon ECS Managed Instances. Changes to storage settings apply to new instances launched after the update. +>>> +>>> storageSizeGiB -> (integer) +>>> +>>>> The size of the tasks volume. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> + +>> +>> monitoring -> (string) +>> +>>> CloudWatch provides two categories of monitoring: basic monitoring and detailed monitoring. By default, your managed instance is configured for basic monitoring. You can optionally enable detailed monitoring to help you more quickly identify and act on operational issues. You can enable or turn off detailed monitoring at launch or when the managed instance is running or stopped. For more information, see [Detailed monitoring for Amazon ECS Managed Instances](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/detailed-monitoring-managed-instances.html) in the Amazon ECS Developer Guide. +>>> +>>> Possible values: +>>> +>>> * `BASIC` +>>> * `DETAILED` +>>> + +>> +>> instanceRequirements -> (structure) +>> +>>> The updated instance requirements for attribute-based instance type selection. Changes to instance requirements affect which instance types Amazon ECS selects for new instances. +>>> +>>> vCpuCount -> (structure) [required] +>>> +>>>> The minimum and maximum number of vCPUs for the instance types. Amazon ECS selects instance types that have vCPU counts within this range. +>>>> +>>>> min -> (integer) [required] +>>>> +>>>>> The minimum number of vCPUs. Instance types with fewer vCPUs than this value are excluded from selection. +>>>> +>>>> max -> (integer) +>>>> +>>>>> The maximum number of vCPUs. Instance types with more vCPUs than this value are excluded from selection. +>>> +>>> memoryMiB -> (structure) [required] +>>> +>>>> The minimum and maximum amount of memory in mebibytes (MiB) for the instance types. Amazon ECS selects instance types that have memory within this range. +>>>> +>>>> min -> (integer) [required] +>>>> +>>>>> The minimum amount of memory in MiB. Instance types with less memory than this value are excluded from selection. +>>>> +>>>> max -> (integer) +>>>> +>>>>> The maximum amount of memory in MiB. Instance types with more memory than this value are excluded from selection. +>>> +>>> cpuManufacturers -> (list) +>>> +>>>> The CPU manufacturers to include or exclude. You can specify `intel` , `amd` , or `amazon-web-services` to control which CPU types are used for your workloads. +>>>> +>>>> (string) +>>>> +>>>>> Possible values: +>>>>> +>>>>> * `intel` +>>>>> * `amd` +>>>>> * `amazon-web-services` +>>>>> + +>>> +>>> memoryGiBPerVCpu -> (structure) +>>> +>>>> The minimum and maximum amount of memory per vCPU in gibibytes (GiB). This helps ensure that instance types have the appropriate memory-to-CPU ratio for your workloads. +>>>> +>>>> min -> (double) +>>>> +>>>>> The minimum amount of memory per vCPU in GiB. Instance types with a lower memory-to-vCPU ratio are excluded from selection. +>>>> +>>>> max -> (double) +>>>> +>>>>> The maximum amount of memory per vCPU in GiB. Instance types with a higher memory-to-vCPU ratio are excluded from selection. +>>> +>>> excludedInstanceTypes -> (list) +>>> +>>>> The instance types to exclude from selection. Use this to prevent Amazon ECS from selecting specific instance types that may not be suitable for your workloads. +>>>> +>>>> Constraints: +>>>> +>>>> * max: `400` +>>>> + +>>>> +>>>> (string) +>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `30` +>>>>> * pattern: `[a-zA-Z0-9\.\*\-]+` +>>>>> + +>>> +>>> instanceGenerations -> (list) +>>> +>>>> The instance generations to include. You can specify `current` to use the latest generation instances, or `previous` to include previous generation instances for cost optimization. +>>>> +>>>> (string) +>>>> +>>>>> Possible values: +>>>>> +>>>>> * `current` +>>>>> * `previous` +>>>>> + +>>> +>>> spotMaxPricePercentageOverLowestPrice -> (integer) +>>> +>>>> The maximum price for Spot instances as a percentage over the lowest priced On-Demand instance. This helps control Spot instance costs while maintaining access to capacity. +>>> +>>> onDemandMaxPricePercentageOverLowestPrice -> (integer) +>>> +>>>> The price protection threshold for On-Demand Instances, as a percentage higher than an identified On-Demand price. The identified On-Demand price is the price of the lowest priced current generation C, M, or R instance type with your specified attributes. If no current generation C, M, or R instance type matches your attributes, then the identified price is from either the lowest priced current generation instance types or, failing that, the lowest priced previous generation instance types that match your attributes. When Amazon ECS selects instance types with your attributes, we will exclude instance types whose price exceeds your specified threshold. +>>> +>>> bareMetal -> (string) +>>> +>>>> Indicates whether to include bare metal instance types. Set to `included` to allow bare metal instances, `excluded` to exclude them, or `required` to use only bare metal instances. +>>>> +>>>> Possible values: +>>>> +>>>> * `included` +>>>> * `required` +>>>> * `excluded` +>>>> + +>>> +>>> burstablePerformance -> (string) +>>> +>>>> Indicates whether to include burstable performance instance types (T2, T3, T3a, T4g). Set to `included` to allow burstable instances, `excluded` to exclude them, or `required` to use only burstable instances. +>>>> +>>>> Possible values: +>>>> +>>>> * `included` +>>>> * `required` +>>>> * `excluded`