AWS AmazonECS documentation change
Summary
Added new error resolution and least-privilege permission guidance
Security assessment
Includes guidance for applying least-privilege permissions to troubleshooting capabilities, enhancing security documentation without addressing a specific vulnerability
Diff
diff --git a/AmazonECS/latest/developerguide/troubleshooting-managed-instances.md b/AmazonECS/latest/developerguide/troubleshooting-managed-instances.md index 65b2eef45..cfd0c29cf 100644 --- a//AmazonECS/latest/developerguide/troubleshooting-managed-instances.md +++ b//AmazonECS/latest/developerguide/troubleshooting-managed-instances.md @@ -5 +5 @@ -Task definition is incompatible with Amazon ECS Managed InstancesCapacity provider not associated with clusterInfrastructure role permission errorsVcpuLimitExceeded errorInsufficientCapacity and related capacity errorsUnauthorizedOperation errorTask timed out waiting for capacityNetwork configuration errors +Task definition is incompatible with Amazon ECS Managed InstancesCapacity provider not associated with clusterInfrastructure role permission errorsVcpuLimitExceeded errorInsufficientCapacity and related capacity errorsUnauthorizedOperation errorTask timed out waiting for capacityNetwork configuration errorsCapacity provider can't be deleted due to stuck instances @@ -10,0 +11,11 @@ When launching tasks with Amazon ECS Managed Instances, Amazon ECS first attempt +###### Note + +If you choose to apply least-privilege permissions and specify your own permissions for the instance profile instead of using the `AmazonECSInstanceRolePolicyForManagedInstances` managed policy, you can add the following permissions to help with troubleshooting task-related issues with Amazon ECS Managed Instances: + + * `ecs:StartTelemetrySession` + + * `ecs:PutSystemLogEvents` + + + + @@ -162,0 +174,16 @@ These errors occur when there are mismatches between your task's network require +## Capacity provider can't be deleted due to stuck instances + +### Common cause + +These errors occur when Amazon ECS Managed Instances are stuck in an `ACTIVE` or `DRAINING` state but there are no running tasks on the instances. + +### Resolution + +To allow the deletion of the capacity provider to proceed, you can force deregister the instances that are stuck using the following command. + + + aws ecs deregister-container-instance \ + --cluster arn:aws:ecs:us-east-1:111122223333:cluster/MyCluster \ + --container-instance arn:aws:ecs:us-east-1:111122223333:container-instance/a1b2c3d4-5678-90ab-cdef-11111EXAMPLE \ + --force +