AWS AWSCloudFormation medium security documentation change
Summary
Clarified IPC and PID namespace isolation behavior with explicit security implications of shared namespaces
Security assessment
Explicitly documents security boundaries: 'none' provides private namespace isolation while 'shared' joins host namespace, directly addressing container escape risks and process visibility concerns
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-daemontaskdefinition.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-daemontaskdefinition.md index 443dbdb25..eea9ef82d 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-daemontaskdefinition.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-daemontaskdefinition.md @@ -106 +106 @@ _Required_ : No -The IPC resource namespace mode for the containers in the daemon task. The valid values are `none` and `shared`. +The IPC namespace mode for the daemon. The valid values are `none` and `shared`. The default is `none`. @@ -108,3 +108 @@ The IPC resource namespace mode for the containers in the daemon task. The valid -If `shared` is specified, all containers within the daemon task share the same IPC resources. - -If `none` is specified, each container in the daemon task has a private IPC namespace. +If `none` is specified or no value is provided, the daemon runs with its own IPC namespace, isolated from other tasks. If `shared` is specified, the daemon joins the host IPC namespace, making it accessible to non-daemon tasks that use `ipcMode: "host"` or other daemons that use `ipcMode: "shared"`. @@ -134,3 +132 @@ _Required_ : No -The process namespace mode for the containers in the daemon task. The valid values are `none` and `shared`. - -If `shared` is specified, all containers within the daemon task share the same process namespace. +The PID namespace mode for the daemon. The valid values are `none` and `shared`. The default is `none`. @@ -138 +134 @@ If `shared` is specified, all containers within the daemon task share the same p -If `none` is specified, each container in the daemon task has a private process namespace. +If `none` is specified or no value is provided, the daemon runs with its own PID namespace, isolated from other tasks. If `shared` is specified, the daemon joins the host PID namespace, making it accessible to non-daemon tasks that use `pidMode: "host"` or other daemons that use `pidMode: "shared"`.