AWS AmazonECS medium security documentation change
Summary
Updated network mode documentation to remove Docker-specific references and clarify security implications of 'host' network mode
Security assessment
The change explicitly states that 'host' network mode bypasses network isolation, which directly impacts security by reducing container isolation. This clarifies a security-relevant configuration choice.
Diff
diff --git a/AmazonECS/latest/developerguide/task_definition_parameters-managed-instances.md b/AmazonECS/latest/developerguide/task_definition_parameters-managed-instances.md index 9e704e29a..dba5faa72 100644 --- a//AmazonECS/latest/developerguide/task_definition_parameters-managed-instances.md +++ b//AmazonECS/latest/developerguide/task_definition_parameters-managed-instances.md @@ -80 +80 @@ Default: `awsvpc` -The Docker networking mode to use for the containers in the task. For Amazon ECS tasks that are hosted on Amazon ECS Managed Instances, the valid values are `awsvpc` and `host`. If no network mode is specified, the default network mode is `awsvpc`. +The networking mode to use for the containers in the task. For Amazon ECS tasks that are hosted on Amazon ECS Managed Instances, the valid values are `awsvpc` and `host`. If no network mode is specified, the default network mode is `awsvpc`. @@ -82 +82 @@ The Docker networking mode to use for the containers in the task. For Amazon ECS -If the network mode is `host`, the task uses the host's network which bypasses Docker's built-in virtual network by mapping container ports directly to the ENI of the Amazon EC2 instance that hosts the task. Dynamic port mappings can’t be used in this network mode. A container in a task definition that uses this mode must specify a specific `hostPort` number. A port number on a host can’t be used by multiple tasks. As a result, you can’t run multiple tasks of the same task definition on a single Amazon EC2 instance. +If the network mode is `host`, the task bypasses network isolation and containers use the host's network stack directly. @@ -172 +172 @@ The following task definition parameters can be used when registering task defin - * Elastic Inference accelerator + * Elastic Inference accelerator (deprecated) @@ -209 +209 @@ Required: No -The IPC resource namespace to use for the containers in the task. The valid values are `host`, `task`, or `none`. If `host` is specified, then all the containers that are within the tasks that specified the `host` IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. If `task` is specified, all the containers that are within the specified task share the same IPC resources. If `none` is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. +The IPC resource namespace to use for the containers in the task. The valid values are `host`, `task`, or `none`. If `host` is specified, then all the containers that are within the tasks that specified the `host` IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. If `task` is specified, all the containers that are within the specified task share the same IPC resources. If `none` is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the container runtime configuration. @@ -280 +280,5 @@ The optional part of a key-value pair that make up a tag. A value acts as a desc -### Elastic Inference accelerator +### Elastic Inference accelerator (deprecated) + +###### Note + +Amazon Elastic Inference (EI) is no longer available to customers. @@ -323 +327 @@ For more information about placement constraints, see [Define which container in -When you register a task definition, you can optionally specify a list of volumes that are passed to the Docker daemon on a container instance. This allows you to use data volumes in your tasks. +When you register a task definition, you can optionally specify a list of volumes for your tasks. This allows you to use data volumes in your tasks. @@ -343 +347 @@ Required: No -This parameter is specified when you're using bind mount host volumes. The contents of the `host` parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If the `host` parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. +This parameter is specified when you're using bind mount host volumes. The contents of the `host` parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If the `host` parameter is empty, then the system assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. @@ -969 +973 @@ Required: No -For the `InferenceAccelerator` type, the `value` matches the `deviceName` for an `InferenceAccelerator` specified in a task definition. For more information, see [Elastic Inference accelerator name](./task_definition_parameters.html#elastic-Inference-accelerator). +For the `InferenceAccelerator` type, the `value` matches the `deviceName` for an `InferenceAccelerator` specified in a task definition. For more information, see [Elastic Inference accelerator name (deprecated)](./task_definition_parameters.html#elastic-Inference-accelerator).