AWS AmazonECS high security documentation change

Service: AmazonECS · 2026-06-13 · Security-related high

File: AmazonECS/latest/developerguide/managed-daemons-task-definitions.md

Summary

Added documentation for PID and IPC namespace sharing parameters (pidMode and ipcMode) in daemon task definitions, including configuration options and example JSON. Also added PERFMON to the list of individual Linux capabilities.

Security assessment

The change documents namespace sharing features (pidMode/ipcMode) that control process isolation boundaries. Sharing namespaces ('shared' mode) breaks container isolation by allowing access to host/other container processes and IPC resources, which could enable privilege escalation or container breakout if misconfigured. The PERFMON capability addition also relates to security-sensitive kernel access.

Diff

diff --git a/AmazonECS/latest/developerguide/managed-daemons-task-definitions.md b/AmazonECS/latest/developerguide/managed-daemons-task-definitions.md
index 29ce5c59a..a183e2568 100644
--- a//AmazonECS/latest/developerguide/managed-daemons-task-definitions.md
+++ b//AmazonECS/latest/developerguide/managed-daemons-task-definitions.md
@@ -7 +7 @@
-Creating a daemon task definitionDaemon task definition parametersNetwork modePrivileged capabilitiesVolumesSupported container parameters
+Creating a daemon task definitionDaemon task definition parametersNetwork modePrivileged capabilitiesPID and IPC namespace sharingVolumesSupported container parameters
@@ -97,0 +98,4 @@ You can use the following parameters when you register a daemon task definition.
+  * `pidMode` \- Controls the PID namespace mode for the daemon.
+
+  * `ipcMode` \- Controls the IPC namespace mode for the daemon.
+
@@ -124 +128 @@ You can grant capabilities in two ways:
-**Individual capabilities** grant only the permissions your daemon needs, following the principle of least privilege. Use the `linuxParameters.capabilities` field to add individual capabilities such as `SYS_ADMIN`, `NET_ADMIN`, `SYS_PTRACE`, and `BPF`:
+**Individual capabilities** grant only the permissions your daemon needs, following the principle of least privilege. Use the `linuxParameters.capabilities` field to add individual capabilities such as `SYS_ADMIN`, `NET_ADMIN`, `SYS_PTRACE`, `BPF`, and `PERFMON`:
@@ -138,0 +143,50 @@ You can grant capabilities in two ways:
+## PID and IPC namespace sharing
+
+On Amazon ECS Managed Instances, daemons support PID and IPC namespace sharing to enable use cases such as security agents, monitoring tools, and observability daemons that need visibility into application task processes or IPC resources.
+
+`pidMode`
+    
+
+Type: String
+
+Required: No
+
+Valid values: `none` | `shared`
+
+Default: `none`
+
+The PID namespace mode for the daemon. If `none` is specified or no value is provided, the daemon runs with its own PID namespace, isolated from other tasks. If `shared` is specified, the daemon joins the host PID namespace, making it accessible to non-daemon tasks that use `pidMode: "host"` or other daemons that use `pidMode: "shared"`.
+
+`ipcMode`
+    
+
+Type: String
+
+Required: No
+
+Valid values: `none` | `shared`
+
+Default: `none`
+
+The IPC namespace mode for the daemon. If `none` is specified or no value is provided, the daemon runs with its own IPC namespace, isolated from other tasks. If `shared` is specified, the daemon joins the host IPC namespace, making it accessible to non-daemon tasks that use `ipcMode: "host"` or other daemons that use `ipcMode: "shared"`.
+
+The following example shows a daemon task definition with both PID and IPC namespace sharing enabled:
+    
+    
+    {
+        "family": "my-monitoring-daemon",
+        "pidMode": "shared",
+        "ipcMode": "shared",
+        "containerDefinitions": [
+            {
+                "name": "monitoring-agent",
+                "image": "public.ecr.aws/my-company/monitoring-agent:latest",
+                "essential": true
+            }
+        ]
+    }
+
+To share the PID namespace with a daemon that has `pidMode` set to `shared`, a non-daemon task must specify `pidMode: "host"` in its task definition. This allows the task's containers to see the daemon's processes and enables use cases such as process monitoring and signal delivery.
+
+To share the IPC namespace with a daemon that has `ipcMode` set to `shared`, a non-daemon task must specify `ipcMode: "host"` in its task definition. This allows the task's containers to access the daemon's IPC resources such as shared memory segments and message queues.
+