AWS cli: ECS describe-service-revisions: document gateway connections/connectors
Summary
Adds AWS CLI reference documentation for two new response fields of describe-service-revisions: gatewayConnections (gateway ARN, route ARN, port name, service URL, accessType PUBLIC/PRIVATE, status, and hostSharedAlb resources including ACM certificate ARN, load balancer/security group/listener/target group ARNs) and gatewayConnectors (port name, health check settings, and filters with accessTypes PUBLIC/PRIVATE). Also bumps the CLI version reference from 2.38.2 to 2.38.3.
Security assessment
The added reference text documents gateway-managed ingress for ECS service revisions, explicitly distinguishing PUBLIC (internet-accessible) from PRIVATE ingress paths and listing the security groups and ACM certificate attached to the gateway-managed ALB. This is descriptive API documentation of a security-relevant configuration surface (public exposure, TLS cert, security groups), not a fix for a specific vulnerability or incident.
Evidence
>>>>>> * `PUBLIC` \- The ingress path is publicly accessible.
Diff
diff --git a/cli/latest/reference/ecs/describe-service-revisions.md b/cli/latest/reference/ecs/describe-service-revisions.md index 96f1c8f..10ac754 100644 --- a//cli/latest/reference/ecs/describe-service-revisions.md +++ b//cli/latest/reference/ecs/describe-service-revisions.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -1731,0 +1732,122 @@ serviceRevisions -> (list) +>>> +>>> gatewayConnections -> (list) +>>> +>>>> The gateway-managed connections for the service revision, including the gateway routes and infrastructure that a gateway created for the service’s connector. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `0` +>>>> * max: `5` +>>>> + +>>>> +>>>> (structure) +>>>> +>>>>> A gateway-managed connection for a service revision. A connection represents the association between the service’s gateway connector and a specific gateway, along with the infrastructure that the gateway created for it. +>>>>> +>>>>> gatewayArn -> (string) +>>>>> +>>>>>> The Amazon Resource Name (ARN) of the gateway. +>>>>> +>>>>> gatewayRouteArn -> (string) +>>>>> +>>>>>> The Amazon Resource Name (ARN) of the gateway route for the connection. +>>>>> +>>>>> portName -> (string) +>>>>> +>>>>>> The name of the service port that receives gateway-managed ingress traffic. +>>>>> +>>>>> serviceUrl -> (string) +>>>>> +>>>>>> The URL that the gateway uses to route ingress traffic to the service. +>>>>> +>>>>> accessType -> (string) +>>>>> +>>>>>> The access type of the gateway ingress path. +>>>>>> +>>>>>> Valid values: +>>>>>> +>>>>>> * `PUBLIC` \- The ingress path is publicly accessible. +>>>>>> * `PRIVATE` \- The ingress path is only accessible privately. +>>>>>> + +>>>>>> +>>>>>> Possible values: +>>>>>> +>>>>>> * `PUBLIC` +>>>>>> * `PRIVATE` +>>>>>> + +>>>>> +>>>>> status -> (string) +>>>>> +>>>>>> The status of the gateway route for the connection. +>>>>>> +>>>>>> Possible values: +>>>>>> +>>>>>> * `ACTIVE` +>>>>>> * `CREATE_IN_PROGRESS` +>>>>>> * `CREATE_FAILED` +>>>>>> * `UPDATE_IN_PROGRESS` +>>>>>> * `UPDATE_FAILED` +>>>>>> * `DELETE_IN_PROGRESS` +>>>>>> * `DELETE_FAILED` +>>>>>> + +>>>>> +>>>>> resources -> (tagged union structure) +>>>>> +>>>>>> The gateway-managed infrastructure resources for the connection. +>>>>>> +>>>>>> ### Note +>>>>>> +>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `hostSharedAlb`. +>>>>>> +>>>>>> hostSharedAlb -> (list) +>>>>>> +>>>>>>> The Application Load Balancer resources for a host-based, shared ALB gateway. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `0` +>>>>>>> * max: `1` +>>>>>>> + +>>>>>>> +>>>>>>> (structure) +>>>>>>> +>>>>>>>> The Application Load Balancer resources that a gateway created and manages for a connection. +>>>>>>>> +>>>>>>>> acmCertificateArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Certificate Manager certificate that is attached to the load balancer listener. +>>>>>>>> +>>>>>>>> loadBalancerArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the load balancer. +>>>>>>>> +>>>>>>>> loadBalancerSecurityGroupArns -> (list) +>>>>>>>> +>>>>>>>>> The Amazon Resource Names (ARNs) of the security groups that the gateway attaches to the load balancer. +>>>>>>>>> +>>>>>>>>> (string) +>>>>>>>> +>>>>>>>> listenerArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the listener on the load balancer. +>>>>>>>> +>>>>>>>> listenerRuleArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the listener rule that routes production traffic to the service. +>>>>>>>> +>>>>>>>> testListenerRuleArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the listener rule that routes test traffic to the service during progressive deployments. +>>>>>>>> +>>>>>>>> targetGroupArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the target group that receives production traffic. +>>>>>>>> +>>>>>>>> alternateTargetGroupArn -> (string) +>>>>>>>> +>>>>>>>>> The Amazon Resource Name (ARN) of the alternate target group that the gateway uses during progressive deployments. @@ -1750,0 +1873,110 @@ serviceRevisions -> (list) +>> +>> gatewayConnectors -> (list) +>> +>>> The gateway connectors that are associated with the service revision. +>>> +>>> Constraints: +>>> +>>> * min: `0` +>>> * max: `1` +>>> + +>>> +>>> (structure) +>>> +>>>> A gateway connector that attaches an Amazon ECS service to a gateway ingress path. The connector specifies the service port that receives gateway-managed ingress traffic, along with the health check and traffic filters that the gateway applies. A service can have at most one gateway connector. +>>>> +>>>> portName -> (string) [required] +>>>> +>>>>> The name of the service port that the gateway routes ingress traffic to. +>>>> +>>>> healthCheck -> (structure) +>>>> +>>>>> The health check that the gateway uses to determine whether the targets for this connector are healthy. +>>>>> +>>>>> healthCheckProtocol -> (string) +>>>>> +>>>>>> The protocol that the gateway uses to perform health checks. +>>>>>> +>>>>>> Valid values: +>>>>>> +>>>>>> * `HTTP` \- Health checks are performed over HTTP. +>>>>>> * `HTTPS` \- Health checks are performed over HTTPS. +>>>>>> + +>>>>>> +>>>>>> Possible values: +>>>>>> +>>>>>> * `HTTP` +>>>>>> * `HTTPS` +>>>>>> + +>>>>> +>>>>> healthCheckPort -> (integer) +>>>>> +>>>>>> The port that the gateway uses to perform health checks on the targets. +>>>>> +>>>>> healthCheckPath -> (string) +>>>>> +>>>>>> The destination path for health check requests. +>>>>> +>>>>> healthCheckTimeoutSeconds -> (integer) +>>>>> +>>>>>> The amount of time, in seconds, during which no response from a target means a failed health check. +>>>>> +>>>>> healthCheckIntervalSeconds -> (integer) +>>>>> +>>>>>> The approximate amount of time, in seconds, between health checks of an individual target. +>>>>> +>>>>> healthyThresholdCount -> (integer) +>>>>> +>>>>>> The number of consecutive successful health checks that a target must pass before the gateway considers it healthy. +>>>>> +>>>>> unhealthyThresholdCount -> (integer) +>>>>> +>>>>>> The number of consecutive failed health checks that a target must fail before the gateway considers it unhealthy. +>>>>> +>>>>> matcher -> (structure) +>>>>> +>>>>>> The HTTP or gRPC codes that indicate a successful health check response from a target.