AWS AWSCloudFormation high security documentation change
Summary
Added security requirements for S3 Files volumes including mandatory IAM role and encryption details
Security assessment
Explicitly mandates Task IAM Role with specific permissions and discusses encryption port configuration. Failure to implement could lead to unauthorized S3 access.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-s3filesvolumeconfiguration.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-s3filesvolumeconfiguration.md index 2f0ec3a68..4126b4817 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-s3filesvolumeconfiguration.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-s3filesvolumeconfiguration.md @@ -11 +11,5 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The `S3FilesVolumeConfiguration` property type specifies Property description not available. for an [AWS::ECS::TaskDefinition](./aws-resource-ecs-taskdefinition.html). +This parameter is specified when you're using an Amazon S3 Files file system for task storage. For more information, see [Amazon S3 Files volumes](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/s3files-volumes.html) in the _Amazon Elastic Container Service Developer Guide_. + +###### Important + +Your task definition must include a Task IAM Role. See [ IAM role for attaching your file system to AWS compute resources](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-prereq-policies.html#s3-files-prereq-iam-compute-role) for required permissions. @@ -42 +46 @@ To declare this entity in your CloudFormation template, use the following syntax -Property description not available. +The full ARN of the S3 Files access point to use. If an access point is specified, the root directory value specified in the `S3FilesVolumeConfiguration` must either be omitted or set to `/` which will enforce the path set on the S3 Files access point. For more information, see [Creating S3 Files access points](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-access-points-creating.html). @@ -53 +57 @@ _Required_ : No -Property description not available. +The full ARN of the S3 Files file system to mount. @@ -64 +68,5 @@ _Required_ : Yes -Property description not available. +The directory within the Amazon S3 Files file system to mount as the root directory. If this parameter is omitted, the root of the Amazon S3 Files file system will be used. Specifying `/` will have the same effect as omitting this parameter. + +###### Important + +If a S3 Files access point is specified in the `accessPointArn`, the root directory parameter must either be omitted or set to `/` which will enforce the path set on the S3 Files access point. @@ -75 +83 @@ _Required_ : No -Property description not available. +The port to use for sending encrypted data between the ECS host and the S3 Files file system. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon S3 Files mount helper uses. For more information, see [S3 Files mount helper](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-mounting.html).