Class: Aws::ECS::Types::TrustedExecutionConfiguration

Inherits:

Struct

Object
Struct
Aws::ECS::Types::TrustedExecutionConfiguration

show all

Defined in:: gems/aws-sdk-ecs/lib/aws-sdk-ecs/types.rb

Overview

The trusted execution configuration for a task. This configuration controls the isolation mode and attestation policy. You set this configuration when you register a task definition.

Trusted execution is supported only for Amazon ECS Managed Instances.

Constant Summary collapse

SENSITIVE =

[]

Instance Attribute Summary collapse

#attestation_policy ⇒ String
The base64-encoded attestation policy envelope for the task.
#isolation_mode ⇒ String
The isolation mode for tasks that use this task definition.

Instance Attribute Details

#attestation_policy ⇒ `String`

The base64-encoded attestation policy envelope for the task. The policy specifies which containers are allowed to run and the runtime configuration that is cryptographically attested. This parameter is required when isolationMode is CONFIDENTIAL_SANDBOX.

Returns:

(String)

# File 'gems/aws-sdk-ecs/lib/aws-sdk-ecs/types.rb', line 20430

class TrustedExecutionConfiguration < Struct.new(
  :isolation_mode,
  :attestation_policy)
  SENSITIVE = []
  include Aws::Structure
end

#isolation_mode ⇒ `String`

The isolation mode for tasks that use this task definition. The isolation mode determines how a task is isolated from other tasks on the same Amazon EC2 instance.

SHARED: The task shares the underlying Amazon EC2 instance with other tasks. This is the default isolation mode.
ISOLATED_SANDBOX: The task runs in its own Nitro Sandbox, which is a lightweight virtual machine that is isolated by the Amazon Web Services Nitro System. Each task's sandbox is isolated from every other task's sandbox on the same Amazon EC2 instance, so one task can't access another task's memory or storage. For more information, see Isolated and confidential tasks in Amazon Elastic Container Service Developer Guide.
CONFIDENTIAL_SANDBOX: The task runs in its own Nitro Sandbox, which is a lightweight virtual machine that is isolated by the Amazon Web Services Nitro System, with cryptographic attestation. The host can't access the sandbox's memory or storage, and only the approved workload can decrypt data that you encrypt with your Key Management Service key. For more information, see Isolated and confidential tasks in Amazon Elastic Container Service Developer Guide.