AWS AmazonECS documentation change
Summary
Added documentation about configuring Amazon ECS tasks in IPv6-only VPC environments, including networking requirements, migration strategies, load balancer configurations, and limitations
Security assessment
The changes focus on IPv6 networking implementation details rather than addressing specific security vulnerabilities. While IPv6 configuration can have security implications, there's no explicit mention of vulnerabilities, patches, or security advisories in the documentation changes.
Diff
diff --git a/AmazonECS/latest/developerguide/managed-instance-networking.md b/AmazonECS/latest/developerguide/managed-instance-networking.md index 53b0fe5a7..d9888db44 100644 --- a//AmazonECS/latest/developerguide/managed-instance-networking.md +++ b//AmazonECS/latest/developerguide/managed-instance-networking.md @@ -4,0 +5,2 @@ +Using a VPC in IPv6-only mode + @@ -13,0 +16,25 @@ Network mode | Description +## Using a VPC in IPv6-only mode + +In an IPv6-only configuration, your Amazon ECS tasks communicate exclusively over IPv6. To set up VPCs and subnets for an IPv6-only configuration, you must add an IPv6 CIDR block to the VPC and create subnets that include only an IPv6 CIDR block. For more information see [Add IPv6 support for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6-add.html) and [Create a subnet](https://docs.aws.amazon.com/vpc/latest/userguide/create-subnets.html) in the _Amazon VPC User Guide_. You must also update route tables with IPv6 targets and configure security groups with IPv6 rules. For more information, see [Configure route tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html) and [Configure security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-security-group-rules.html) in the _Amazon VPC User Guide_. + +The following considerations apply: + + * You can update an IPv4-only or dualstack Amazon ECS service to an IPv6-only configuration by either updating the service directly to use IPv6-only subnets or by creating a parallel IPv6-only service and using Amazon ECS blue-green deployments to shift traffic to the new service. For more information about Amazon ECS blue-green deployments, see [Amazon ECS blue/green deployments](./deployment-type-blue-green.html). + + * An IPv6-only Amazon ECS service must use dualstack load balancers with IPv6 target groups. If you're migrating an existing Amazon ECS service that's behind a Application Load Balancer or a Network Load Balancer, you can create a new dualstack load balancer and shift traffic from the old load balancer, or update the IP address type of the existing load balancer. + +For more information about Network Load Balancers, see [Create a Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-network-load-balancer.html) and [Update the IP address types for your Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-ip-address-type.html) in the _User Guide for Network Load Balancers_. For more information about Application Load Balancers, see [Create an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html) and [Update the IP address types for your Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-ip-address-type.html) in the _User Guide for Application Load Balancers_. + + * For Amazon ECS tasks in an IPv6-only configuration to communicate with IPv4-only endpoints, you can set up DNS64 and NAT64 for network address translation from IPv6 to IPv4. For more information, see [DNS64 and NAT64](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html) in the _Amazon VPC User Guide_. + + * Amazon ECS workloads in an IPv6-only configuration must use Amazon ECR dualstack image URI endpoints when pulling images from Amazon ECR. For more information, see [Getting started with making requests over IPv6](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-requests.html#ipv6-access-getting-started) in the _Amazon Elastic Container Registry User Guide_. + +###### Note + +Amazon ECR doesn't support dualstack interface VPC endpoints that tasks in an IPv6-only configuration can use. For more information, see [Getting started with making requests over IPv6](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-requests.html#ipv6-access-getting-started) in the _Amazon Elastic Container Registry User Guide_. + + * Amazon ECS Exec isn't supported in an IPv6-only configuration. + + + +