AWS AmazonECS high security documentation change
Summary
Added 'Organization controls' section detailing SCP restrictions and AMI account requirements for ECS Managed Instances
Security assessment
The change documents security-critical Service Control Policy (SCP) configurations to prevent unintended AMI launches. It includes explicit security guidance with an example SCP policy and region-specific AMI account IDs to prevent misconfigurations that could lead to unauthorized instance launches.
Diff
diff --git a/AmazonECS/latest/developerguide/ManagedInstances.md b/AmazonECS/latest/developerguide/ManagedInstances.md index cd2fa1683..6a7e381c7 100644 --- a//AmazonECS/latest/developerguide/ManagedInstances.md +++ b//AmazonECS/latest/developerguide/ManagedInstances.md @@ -5 +5 @@ -Getting startedCapacity providersInstance selection and optimizationTask definitionsOperating system and CPU architectureKey featuresIAM rolesSecurity and complianceNetworkingInstance storageService load balancingMonitoring and observabilityPricing and cost optimizationService quotasMigration considerationsLimitations and considerations +Getting startedCapacity providersInstance selection and optimizationTask definitionsOperating system and CPU architectureKey featuresIAM rolesSecurity and complianceNetworkingInstance storageService load balancingMonitoring and observabilityPricing and cost optimizationService quotasMigration considerationsLimitations and considerationsOrganization controls @@ -275,0 +276,77 @@ The following limitations apply to Amazon ECS Managed Instances: +## Organization controls + +Some organization controls can prevent Amazon ECS Managed Instances from functioning correctly. If so, you must update these controls to allow Amazon ECS to have the permissions required to manage EC2 instances on your behalf. + +Amazon ECS uses an infrastructure role for launching the EC2 instances that back Amazon ECS Managed Instances. This infrastructure role is an [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) which is created in your account that allows Amazon ECS to manage the Amazon ECS Managed Instances on your behalf. [Service Control Policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) (SCPs) always apply to actions performed with infrastructure roles. This allows an SCP to inhibit Amazon ECS Managed Instances operations. The most common occurrence is when an SCP is used to restrict the Amazon Machine Images (AMIs) that can be launched. To allow Amazon ECS Managed Instances to function, modify the SCP to permit launching AMIs from Amazon ECS Managed Instances AMI accounts. + +You can also use the [EC2 Allowed AMIs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-allowed-amis.html) feature to limit the visibility of AMIs in other accounts. If you use this feature, you must expand the image criteria to also include the Amazon ECS Managed Instances AMI accounts in the regions of interest. + +### Example SCP to block all AMIs except for Amazon ECS Managed Instances AMIs + +The SCP below prevents calling `ec2:RunInstances` unless the AMI belongs to the Amazon ECS Managed Instances AMI account for us-west-2 or us-east-1. + +###### Note + +It's important **not** to use the `ec2:Owner` context key. Amazon owns the Amazon ECS Managed Instances AMI accounts and the value for this key will always be `amazon`. Constructing an SCP that allows launching AMIs if the `ec2:Owner` is `amazon` will allow launching any Amazon owned AMI, not just those for Amazon ECS Managed Instances. + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "DenyAMI", + "Effect": "Deny", + "Action": "ec2:RunInstances", + "Resource": "arn:*:ec2:*::image/ami-*", + "Condition": { + "StringNotEquals": { + "aws:ResourceAccount": [ + "187296253231", + "260073348889" + ] + } + } + } + ] + } + +### Amazon ECS Managed Instances AMI accounts + +AWS accounts that vary by region host Amazon ECS Managed Instances public AMIs. + +AWS Region | Account +---|--- +af-south-1 | 070957084703 +ap-east-1 | 587573215167 +ap-northeast-1 | 679336465495 +ap-northeast-2 | 309903600357 +ap-northeast-3 | 384570461223 +ap-south-1 | 062344138989 +ap-south-2 | 624198668379 +ap-southeast-1 | 832199679391 +ap-southeast-2 | 552073033681 +ap-southeast-3 | 368903466070 +ap-southeast-4 | 696793786439 +ap-southeast-5 | 003457290689 +ap-southeast-6 | 465836752572 +ap-southeast-7 | 622515864387 +ca-central-1 | 853167153192 +ca-west-1 | 899469777611 +eu-central-1 | 832570432258 +eu-central-2 | 041659148495 +eu-north-1 | 851563870067 +eu-south-1 | 766433696616 +eu-south-2 | 003380494496 +eu-west-1 | 986619735082 +eu-west-2 | 591706807364 +eu-west-3 | 108582616801 +il-central-1 | 009537862704 +me-central-1 | 540883425316 +me-south-1 | 181438624895 +mx-central-1 | 210749644920 +sa-east-1 | 591338347621 +us-east-1 | 260073348889 +us-east-2 | 292185169523 +us-west-1 | 187296253231 +us-west-2 | 491085424538 +