AWS AmazonECS documentation change

Service: AmazonECS · 2025-10-13 · Documentation medium

File: AmazonECS/latest/developerguide/managed-instances-instance-profile.md

Summary

Reordered CLI instructions and added note about least-privilege permissions for troubleshooting

Security assessment

Explicitly recommends applying least-privilege permissions and specifies required troubleshooting permissions, which enhances security documentation but does not fix a specific vulnerability

Diff

diff --git a/AmazonECS/latest/developerguide/managed-instances-instance-profile.md b/AmazonECS/latest/developerguide/managed-instances-instance-profile.md
index d196889f1..5c5b60c70 100644
--- a//AmazonECS/latest/developerguide/managed-instances-instance-profile.md
+++ b//AmazonECS/latest/developerguide/managed-instances-instance-profile.md
@@ -5 +5 @@
-Create the instance profile using the AWS CLICreate the role with the trust policy
+Create the role with the trust policyCreate the instance profile using the AWS CLI
@@ -15,19 +14,0 @@ If you are using Amazon ECS Managed Instances with the AWS-managed Infrastructur
-## Create the instance profile using the AWS CLI
-
-After creating the role, create the instance profile using the AWS CLI:
-    
-    
-    aws iam create-instance-profile --instance-profile-name ecsInstanceRole 
-
-Add the role to the instance profile:
-    
-    
-    aws iam add-role-to-instance-profile \
-       --instance-profile-name ecsInstanceRole \
-       --role-name ecsInstanceRole 
-
-Verify the profile was created successfully:
-    
-    
-    aws iam get-instance-profile --instance-profile-name ecsInstanceRole 
-
@@ -69,0 +51,8 @@ JSON
+###### Note
+
+If you choose to apply least-privilege permissions and specify your own permissions instead, you can add the following permissions to help with troubleshooting task-related issues with Amazon ECS Managed Instances: 
+
+     * `ecs:StartTelemetrySession`
+
+     * `ecs:PutSystemLogEvents`
+
@@ -76,0 +66,19 @@ After you create the file, you must grant your user permission to pass the role
+## Create the instance profile using the AWS CLI
+
+After creating the role, create the instance profile using the AWS CLI:
+    
+    
+    aws iam create-instance-profile --instance-profile-name ecsInstanceRole 
+
+Add the role to the instance profile:
+    
+    
+    aws iam add-role-to-instance-profile \
+       --instance-profile-name ecsInstanceRole \
+       --role-name ecsInstanceRole 
+
+Verify the profile was created successfully:
+    
+    
+    aws iam get-instance-profile --instance-profile-name ecsInstanceRole 
+