AWS AmazonECS documentation change

Service: AmazonECS · 2026-02-25 · Documentation low

File: AmazonECS/latest/developerguide/security-iam-awsmanpol.md

Summary

Expanded IAM policy documentation for AmazonECSInfrastructureRolePolicyForManagedInstances with new capacity reservation permissions

Security assessment

Adds documentation for new resource-group and EC2 permissions required for capacity reservations. While security-related documentation, there's no indication of fixing a vulnerability.

Diff

diff --git a/AmazonECS/latest/developerguide/security-iam-awsmanpol.md b/AmazonECS/latest/developerguide/security-iam-awsmanpol.md
index 825fbc88e..9f44a94f1 100644
--- a//AmazonECS/latest/developerguide/security-iam-awsmanpol.md
+++ b//AmazonECS/latest/developerguide/security-iam-awsmanpol.md
@@ -139 +139,3 @@ You can attach the `AmazonECSInfrastructureRolePolicyForManagedInstances` policy
-  * Read-only permissions to describe Amazon EC2 resources including instances, instance types, launch templates, network interfaces, availability zones, security groups, subnets, VPCs and EC2 Images
+  * Read-only permissions to describe Amazon EC2 resources including instances, instance types, launch templates, network interfaces, availability zones, security groups, subnets, VPCs, EC2 Images and capacity reservations
+
+  * Read-only permissions to list Amazon ResourceGroups resources, which requires underlying permissions to get tagged resources and list Amazon CloudFormation stack resources
@@ -232,0 +235,7 @@ Change | Description | Date
+Update `AmazonECSInfrastructureRolePolicyForManagedInstances` policy  |  The `AmazonECSInfrastructureRolePolicyForManagedInstances` policy has been updated with the following permissions to support Capacity Reservations on Amazon ECS Managed Instances: 
+
+  * `resource-groups:ListGroupResources` permission has been added to allow Amazon ECS to fetch a grouping of capacity reservations. To run this command, the following permissions are also required: `cloudformation:DescribeStacks`, `cloudformation:ListStackResources`, `tag:GetResources`
+  * `ec2:DescribeCapacityReservations` permission has been added to allow Amazon ECS to gather details about capacity reservations necessary to integrate with Amazon ECS Managed Instances.
+  * `ec2:RunInstances` permission has been modified to include Amazon ResourceGroups group resources for Amazon ECS to provision targeted Amazon EC2 capacity reservations.
+
+| February 24, 2026