View a markdown version of this page

TrustedExecutionSummary - Amazon Elastic Container Service
ContentsSee Also
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

TrustedExecutionSummary

A summary of the trusted execution configuration for a task. This is a read-only view of the isolation configuration that was set on the task definition. Use it to see a task's isolation configuration in the response to DescribeTasks, RunTask, or StopTask without calling DescribeTaskDefinition. This summary never includes the attestation policy itself.

Note

Trusted execution is supported only for Amazon ECS Managed Instances.

Contents

isolationMode

The isolation mode that the task runs in. This value mirrors the isolationMode that was set in the task definition's TrustedExecutionConfiguration.

  • SHARED: The task shares the underlying Amazon EC2 instance with other tasks. This is the default isolation mode.

  • ISOLATED_SANDBOX: The task runs in its own Nitro Sandbox, which is a lightweight virtual machine that is isolated by the Amazon Nitro System. Each task's sandbox is isolated from every other task's sandbox on the same Amazon EC2 instance, so one task can't access another task's memory or storage. For more information, see Isolated and confidential tasks in Amazon Elastic Container Service Developer Guide.

  • CONFIDENTIAL_SANDBOX: The task runs in its own Nitro Sandbox, which is a lightweight virtual machine that is isolated by the Amazon Nitro System, with cryptographic attestation. The host can't access the sandbox's memory or storage, and only the approved workload can decrypt data that you encrypt with your Amazon Key Management Service key. For more information, see Isolated and confidential tasks in Amazon Elastic Container Service Developer Guide.

Type: String

Valid Values: SHARED | ISOLATED_SANDBOX | CONFIDENTIAL_SANDBOX

Required: Yes

attestationPolicyStatus

The status of the attestation policy for the task. This value is present only for tasks that use the CONFIDENTIAL_SANDBOX isolation mode.

Type: String

Valid Values: CONFIGURED

Required: No

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: