AWS AmazonECS documentation change
Summary
Added prerequisite about requiring a default VPC with public subnets for Express Mode services and noted IAM role propagation delays.
Security assessment
Changes are operational guidance about VPC requirements and IAM role propagation timing. No security vulnerabilities or security features are mentioned. The VPC note relates to network architecture best practices without security implications.
Diff
diff --git a/AmazonECS/latest/developerguide/express-service-getting-started.md b/AmazonECS/latest/developerguide/express-service-getting-started.md index 0e4d43c5e..d7b83e6bc 100644 --- a//AmazonECS/latest/developerguide/express-service-getting-started.md +++ b//AmazonECS/latest/developerguide/express-service-getting-started.md @@ -22,0 +23,2 @@ Before you begin, ensure you have: + * A default VPC with public subnets in the AWS Region where you create the service. By default, Express Mode service creates an internet-facing load balancer in your account's default VPC and public subnets. If your account does not have a default VPC, create one before you begin, or specify your own subnets when you create the service. For more information, see [Default VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html) in the _Amazon VPC User Guide_. + @@ -41 +43 @@ An Express Mode service requires two IAM roles. The Task Execution Role allows A - "Action": "sts:AssumeRole", + "Action": "sts:AssumeRole" @@ -69,0 +72,4 @@ For more information, see [Amazon ECS task execution IAM role](./task_execution_ +###### Note + +IAM roles are eventually consistent, so a newly created role might not be usable immediately. If your first `create-express-gateway-service` call fails with `Unable to assume the service linked role` (or a similar assume-role error) right after you create these roles, wait a short time (about a minute) for the roles to propagate, and then retry the command. +