Task definition parameters

Type: Integer

Required: Yes, when portMappings are

The port number on the container that's bound to the user-specified or automatically assigned host port.

If using containers in a task with the Fargate launch type, exposed ports must be specified using containerPort .

For Windows containers on Fargate, you can't use port 3150 for the containerPort . This is because it's reserved.

Suppose that you're using containers in a task with the EC2 launch type and you specify a container port and not a host port. Then, your container automatically receives a host port in the ephemeral port range. For more information, see hostPort . Port mappings that are automatically assigned in this way don't count toward the 100 reserved ports quota of a container instance.

Type: String

Required: No

The port number range on the container that's bound to the dynamically mapped host port range.

You can only set this parameter by using the register-task-definition API. The option is available in the portMappings parameter. For more information, see register-task-definition in the AWS Command Line Interface Reference .

The following rules apply when you specify a containerPortRange :

The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the ecs-init package.

You can specify a maximum of 100 port ranges for each container.

You don't specify a hostPortRange . The value of the hostPortRange is set as follows:

For containers in a task with the awsvpc network mode, the hostPort is set to the same value as the containerPort . This is a static mapping strategy.

For containers in a task with the bridge network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.

The containerPortRange valid values are between 1 and 65535.

A port can only be included in one port mapping for each container.

You can't specify overlapping port ranges.

The first port in the range must be less than last port in the range.

Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports.

For more information, see Issue #11185 on GitHub.

For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide .

You can call DescribeTasks to view the hostPortRange , which are the host ports that are bound to the container ports.

The port ranges aren't included in the Amazon ECS task events, which are sent to EventBridge. For more information, see Automate responses to Amazon ECS errors using EventBridge .

Type: String

Required: No

The port number range on the host that's used with the network binding. This is assigned by Docker and delivered by the Amazon ECS agent.

Type: Integer

Required: No

The port number on the container instance to reserve for your container.

If using containers in a task with the Fargate launch type, the hostPort can either be kept blank or be the same value as containerPort .

Suppose that you're using containers in a task with the EC2 launch type. You can specify a non-reserved host port for your container port mapping. This is referred to as static host port mapping. Or, you can omit the hostPort (or set it to 0 ) while specifying a containerPort . Your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. This is referred to as dynamic host port mapping.

The default ephemeral port range Docker version 1.6.0 and later is listed on the instance under /proc/sys/net/ipv4/ip_local_port_range . If this kernel parameter is unavailable, the default ephemeral port range from 49153–65535 is used. Don't attempt to specify a host port in the ephemeral port range. This is because these are reserved for automatic assignment. In general, ports under 32768 are outside of the ephemeral port range.

The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376 , and the Amazon ECS container agent ports 51678-51680 . Any host port that was previously user-specified for a running task is also reserved while the task is running. After a task stops, the host port is released. The current reserved ports are displayed in the remainingResources of describe-container-instances output. A container instance might have up to 100 reserved ports at a time, including the default reserved ports. Automatically assigned ports don't count toward the 100 reserved ports quota.

Type: String

Required: No, required for Service Connect to be configured in a service

The name that's used for the port mapping. This parameter only applies to Service Connect. This parameter is the name that you use in the Service Connect configuration of a service.

For more information, see Service Connect .

In the following example, both of the required fields for Service Connect are used.

Type: String

Required: No

The protocol that's used for the port mapping. Valid values are tcp and udp . The default is tcp .

If you're specifying a host port, use the following syntax.

"portMappings": [
        "containerPort": integer,
        "hostPort": integer
						
If you want an automatically assigned host port, use the following
							syntax.
						
"portMappings": [
        "containerPort": integer
						
Type: RepositoryCredentials object
						
Required: No
						
The repository credentials for private registry authentication.
						
For more information, see Private registry authentication for tasks.
									
Required: Yes, when repositoryCredentials
										are used
									
The Amazon Resource Name (ARN) of the secret containing the private
										repository credentials.
									
For more information, see Private registry authentication for tasks.
									
Note
When you use the Amazon ECS API, AWS CLI, or AWS SDKs, if
											the secret exists in the same Region as the task that
											you're launching then you can use either the full ARN or
											the name of the secret. When you use the AWS Management Console, you
											must specify the full ARN of the secret.
									
The following is a snippet of a task definition that shows
										the required parameters:
"containerDefinitions": [
        "image": "private-repo/private-image",
        "repositoryCredentials": {
            "credentialsParameter": "arn:aws:secretsmanager:region:aws_account_id:secret:secret_name"
		
Advanced container definition
				parameters
		
The following advanced container definition parameters provide extended capabilities
			to the docker run command that's used to launch containers
			on your Amazon ECS container instances.
		
Topics
Health check
Environment
Network settings
Storage and logging
Security
Resource limits
Docker labels
			
Health check
					
healthCheck
						
The container health check command and the associated configuration parameters for the
							container.  For more information, see Determine Amazon ECS task health using container health checks.
									
A string array that represents the command that the
										container runs to determine if it's healthy. The string
										array can start with CMD to run the command
										arguments directly, or CMD-SHELL to run the
										command with the container's default shell. If neither is
										specified, CMD is
										used.
									
When registering a task definition in the AWS Management Console, use a
										comma separated list of commands. These commands are
										converted to a string after the task definition is created.
										An example input for a health check is the following.
									
CMD-SHELL, curl -f http://localhost/ || exit 1
									
When registering a task definition using the AWS Management Console
										JSON panel, the AWS CLI, or the APIs, enclose the list of
										commands in brackets. An example input for a health check is
										the following.
									





    
[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
									
An exit code of 0, with no stderr output,
										indicates success, and a non-zero exit code indicates
										failure. For more information, see HealthCheck
										in the Create a container section of the
										Docker Remote API.
								
interval
									
The period of time (in seconds) between each health check.
										You can specify between 5 and 300 seconds. The default value
										is 30 seconds.
								
timeout
									
The period of time (in seconds) to wait for a health check
										to succeed before it's considered a failure. You can specify
										between 2 and 60 seconds. The default value is 5
										seconds.
								
retries
									
The number of times to retry a failed health check before
										the container is considered unhealthy. You can specify
										between 1 and 10 retries. The default value is three
										retries.
								
startPeriod
									
The optional grace period to provide containers time to
										bootstrap in before failed health checks count towards the
										maximum number of retries. You can specify between 0 and 300
										seconds. By default, startPeriod is
										disabled.
						
Required: No
						
The number of cpu units the Amazon ECS container agent
							reserves for the container. On Linux, this parameter maps to
								CpuShares
							in the
							Create a container section of the Docker Remote API and
							the --cpu-shares option to docker run.
						
This field is optional for tasks that use the Fargate
							launch type. The total amount of CPU reserved for all the containers
							that are within a task must be lower than the task-level
								cpu value.
						
Note
You can determine the number of CPU units that are available to
								each Amazon EC2 instance type. To do this, multiply the number of vCPUs
								listed for that instance type on the Amazon EC2
									Instances detail page by 1,024.
						
Linux containers share unallocated CPU units with other
							containers on the container instance with the same ratio as their
							allocated amount. For example, assume that you run a single-container
							task on a single-core instance type with 512 CPU units specified for
							that container. Moreover, that task is the only task running on the
							container instance. In this example, the container can use the full
							1,024 CPU unit share at any given time. However, assume then that you
							launched another copy of the same task on that container instance. Each
							task is guaranteed a minimum of 512 CPU units when needed. Similarly, if
							the other container isn't using the remaining CPU, each container can
							float to higher CPU usage. However, if both tasks were 100% active all
							of the time, they are limited to 512 CPU units.
						
On Linux container instances, the Docker
							daemon on the container instance uses the CPU value to calculate the
							relative CPU share ratios for running containers. For more information,
							see CPU share constraint in the Docker documentation. The
							minimum valid CPU share value that the Linux kernel allows is 2.
							However, the CPU parameter isn't required, and you can use CPU values
							below two in your container definitions. For CPU values below two
							(including null), the behavior varies based on your Amazon ECS container
							agent version:
								
Agent versions <= 1.1.0:
									Null and zero CPU values are passed to Docker as
									0. Docker then converts this value to 1,024 CPU
									shares. CPU values of one are passed to Docker as
									one, which the Linux kernel converts to two CPU
									shares.
								
Agent versions >= 1.2.0:
									Null, zero, and CPU values of one are passed to
										Docker as two CPU shares.
						
On Windows container instances, the CPU quota is
							enforced as an absolute quota. Windows containers only
							have access to the specified amount of CPU that's defined in the task
							definition. A null or zero CPU value is passed to Docker
							as 0. Windows then interprets this value as
							1% of one
						
For more examples, see How Amazon ECS manages CPU and memory resources.
						
Type: ResourceRequirement object
						
Required: No
						
The number of physical GPUs that the Amazon ECS container
							agent reserves for the container. The number of GPUs reserved for all
							containers in a task must not exceed the number of available GPUs on the
							container instance the task is launched on. For more information, see
								Working with GPUs on Amazon ECS.
						
Note
This parameter isn't supported for Windows
								containers or containers that are hosted on
								Fargate.
					
Elastic Inference
							accelerator
						
Type: ResourceRequirement object
						
Required: No
						
For the InferenceAccelerator type, the value
							matches the deviceName for an
								InferenceAccelerator specified in a task definition.
							For more information, see Elastic Inference accelerator
                name.
						
Note
Starting April 15, 2023, AWS will not onboard new customers to Amazon Elastic Inference (EI), and will help current customers migrate their workloads to options that offer better price and performance. After April 15, 2023, new customers will not be able to launch instances with Amazon EI accelerators in Amazon SageMaker, Amazon ECS, or Amazon EC2. However, customers who have used Amazon EI at least once during the past 30-day period are considered current customers and will be able to continue using the service. 
						
Note
This parameter isn't supported for Windows
								containers or containers that are hosted on
								Fargate.
					
essential
						
Type: Boolean
						
Required: No
						
Suppose that the essential parameter of a container is
							marked as true, and that container fails or stops for any
							reason. Then, all other containers that are part of the task are
							stopped. If the essential parameter of a container is
							marked as false, then its failure doesn't affect the rest
							of the containers in a task. If this parameter is omitted, a container
							is assumed to be essential.
						
All tasks must have at least one essential container. Suppose that you
							have an application that's composed of multiple containers. Then, group
							containers that are used for a common purpose into components, and
							separate the different components into multiple task definitions. For
							more information, see Architecting your application.
						
"essential": true|false
					
entryPoint
						
Important
Early versions of the Amazon ECS container agent don't properly handle
									entryPoint parameters. If you have problems using
									entryPoint, update your container agent or enter
								your commands and arguments as command array items
								instead.
						
Type: String array
						
Required: No
						
The entry point that's passed to the container. This parameter maps to
								Entrypoint in the Create a container
							section of the Docker Remote API and the --entrypoint
							option to docker run. For more information
							about the Docker
							ENTRYPOINT parameter, see https://docs.docker.com/engine/reference/builder/#entrypoint. 
						
"entryPoint": ["string", ...]
					
command
						
Type: String array
						
Required: No
						
The command that's passed to the container. This parameter maps to
								Cmd in the Create a container section
							of the Docker Remote API and the COMMAND parameter to
								docker run. For more information
							about the Docker
							CMD parameter, see https://docs.docker.com/engine/reference/builder/#cmd. If
							there are multiple arguments, make sure that each argument is a
							separated string in the array.
						
"command": ["string", ...]
					
workingDirectory
						
Type: String
						
Required: No
						
The working directory to run commands inside the container in. This
							parameter maps to WorkingDir in the
							Create a container section of the Docker Remote API and
							the --workdir option to docker run.
						
"workingDirectory": "string"
					
environmentFiles
						
Type: Object array
						
Required: No
						
A list of files containing the environment variables to pass to a
							container. This parameter maps to the --env-file option to
								docker run.
						
This isn't available for Windows containers.
						
You can specify up to 10 environment files. The file must have a
								.env file extension. Each line in an environment file
							contains an environment variable in VARIABLE=VALUE format.
							Lines that start with # are treated as comments and are
							ignored. For more information about the appropriate environment variable
							file syntax, see Declare default environment variables in file.
						
If there are individual environment variables specified in the
							container definition, they take precedence over the variables contained
							within an environment file. If multiple environment files are specified
							that contain the same variable, they're processed from the top down. We
							recommend that you use unique variable names. For more information, see
								Use task definition parameters to pass environment
            variables to a container.
									
Required: Yes
									
The Amazon Resource Name (ARN) of the Amazon S3 object
										containing the environment variable file.
									
Type: String
									
Required: Yes
									
The file type to use. The only supported value is
						
Type: Object array
						
Required: No
						
The environment variables to pass to a container. This parameter maps
							to Env in the Create a container section of
							the Docker Remote API and the --env option to docker run.
						
Important
We do not recommend using plaintext environment variables for
								sensitive information, such as credential data.
						
"environment" : [
    { "name" : "string", "value" : "string" },
    { "name" : "string", "value" : "string" }
					
secrets
						
Type: Object array
						
Required: No
						
An object that represents the secret to expose to your container. For
							more information, see Passing sensitive data to an Amazon ECS
				container.
									
Required: Yes
									
The secret to expose to the container. The supported
										values are either the full Amazon Resource Name (ARN) of the AWS Secrets Manager secret
										or the full ARN of the parameter in the AWS Systems Manager Parameter
										Store.
									
Note




    
If the Systems Manager Parameter Store parameter exists in the
											same AWS Region as the task that you're launching, you
											can use either the full ARN or name of the secret. If
											the parameter exists in a different Region, then the
											full ARN must be specified.
						
"secrets": [
        "name": "environment_variable_name",
        "valueFrom": "arn:aws:ssm:region:aws_account_id:parameter/parameter_name"
						
Type: Boolean
						
Required: No
						
When this parameter is true, networking is off within the container.
							This parameter maps to NetworkDisabled in the
							Create a container section of the
							Docker Remote API.
						
Note
This parameter isn't supported for Windows
								containers or tasks using the awsvpc network
								mode.
						
The default is false.
						
"disableNetworking": true|false
					
links
						
Type: String array
						
Required: No
						
The link parameter allows containers to communicate with
							each other without the need for port mappings. This parameter is only
							supported if the network mode of a task definition is set to
								bridge. The name:internalName construct is
							analogous to name:alias in Docker links.
							Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. For more information about linking
								Docker containers, see https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/.
							This parameter maps to Links in the
							Create a container section of the Docker Remote API and
							the --link option to docker run.
						
Note
This parameter isn't supported for Windows
								containers or tasks using the awsvpc network
								mode.
						
Important
Containers that are collocated on the same container instance
								might communicate with each other without requiring links or host
								port mappings. The network isolation on a container instance is
								controlled by security groups and VPC settings.
						
"links": ["name:internalName", ...]
					
hostname
						
Type: String
						
Required: No
						
The hostname to use for your container. This parameter maps to
								Hostname in the Create a container
							section of the Docker Remote API and the --hostname option
							to docker run.
						
Note
If you're using the awsvpc network mode, the
									hostname parameter isn't supported.
						
"hostname": "string"
					
dnsServers
						
Type: String array
						
Required: No
						
A list of DNS servers that are presented to the container. This
							parameter maps to Dns in the
							Create a container section of the Docker Remote API and
							the --dns option to docker run.
						
Note
This parameter isn't supported for Windows
								containers or tasks using the awsvpc network
								mode.
						
"dnsServers": ["string", ...]
					
dnsSearchDomains
						
Type: String array
						
Required: No
						
Pattern: ^[a-zA-Z0-9-.]{0,253}[a-zA-Z0-9]$
						
A list of DNS search domains that are presented to the container. This
							parameter maps to DnsSearch in the
							Create a container section of the Docker Remote API and
							the --dns-search option to docker run.
						
Note
This parameter isn't supported for Windows containers or tasks
								that use the awsvpc network mode.
						
"dnsSearchDomains": ["string", ...]
					
extraHosts
						
Type: Object array
						
Required: No
						
A list of hostnames and IP address mappings to append to the
								/etc/hosts file on the container. 
						
This parameter maps to ExtraHosts in the
							Create a container section of the Docker Remote API and
							the --add-host option to docker run.
						
Note
This parameter isn't supported for Windows containers or tasks
								that use the awsvpc network mode.
						
"extraHosts": [
        "hostname": "string",
        "ipAddress": "string"
						
Type: Boolean
						
Required: No
						
When this parameter is true, the container is given read-only access
							to its root file system. This parameter maps to
								ReadonlyRootfs in the
							Create a container section of the Docker Remote API and
							the --read-only option to docker run.
						
Note
This parameter is not supported for Windows containers.
						
The default is false.
						
"readonlyRootFilesystem": true|false
    
mountPoints
        
Type: Object array
        
Required: No
        
The mount points for the data volumes in your container. This parameter maps to Volumes in the
            Create a container section of the Docker Remote API and
            the --volume option to docker run.
        
Windows containers can mount whole directories on the same drive as
            $env:ProgramData. Windows containers cannot mount
            directories on a different drive, and mount points cannot be used across
            drives.
                    
Required: Yes, when mountPoints are
                    
The path in the container where the volume will be mounted.
                
readOnly
                    
Type: Boolean
                    
Required: No
                    
If this value is true, the container has
                        read-only access to the volume. If this value is
                        false, then the container can write to the
                        volume. The default value is false.
						
Type: Object array
						
Required: No
						
Data volumes to mount from another container. This parameter maps to
								VolumesFrom in the Create a container
							section of the Docker Remote API and the --volumes-from
							option to docker run.
									
Required: No
									
If this value is true, the container has
										read-only access to the volume. If this value is
											false, then the container can write to the
										volume. The default value is false.
						
"volumesFrom": [
                  "sourceContainer": "string",
                  "readOnly": true|false
					
logConfiguration
						
Type: LogConfiguration Object
						
Required: No
						
The log configuration specification for the container.
						
For example task definitions that use a log configuration, see Example task definitions.
						
This parameter maps to LogConfig in the
							Create a container section of the Docker Remote API and
							the --log-driver option to docker run. By default, containers use the
							same logging driver that the Docker daemon uses. However,
							the container might use a different logging driver than the
								Docker daemon by specifying a log driver with this
							parameter in the container definition. To use a different logging driver
							for a container, the log system must be configured properly on the
							container instance (or on a different log server for remote logging
							options). For more information about the options for different supported
							log drivers, see Configure logging drivers in the Docker
							documentation.
						
Consider the following when specifying a log configuration for your
							containers:
								
Amazon ECS supports a subset of the logging drivers that are
									available to the Docker daemon. Additional log
									drivers might be available in future releases of the Amazon ECS
									container agent.
								
This parameter requires version 1.18 or later of the
										Docker Remote API on your container
									instance.
								
For tasks that use the EC2 launch type, the
									Amazon ECS container agent that runs on a container instance must
									register the logging drivers that are available on that instance
									with the ECS_AVAILABLE_LOGGING_DRIVERS environment
									variable before containers that are placed on that instance can
									use these log configuration options. For more information, see
										Amazon ECS container agent configuration.
								
For tasks that use the Fargate launch type,
									because you don't have access to the underlying infrastructure
									your tasks are hosted on, any additional software needed must be
									installed outside of the task. For example, the
										Fluentd output aggregators or a remote host
									running Logstash to send Gelf logs to.
						
"logConfiguration": {
      "logDriver": "awslogs","fluentd","gelf","json-file","journald","logentries","splunk","syslog","awsfirelens",
      "options": {"string": "string"
        ...},
	"secretOptions": [{
		"name": "string",
		"valueFrom": "string"
									
Type: String
									
Valid values:
											"awslogs","fluentd","gelf","json-file","journald","logentries","splunk","syslog","awsfirelens"
									
Required: Yes, when logConfiguration is
									
The log driver to use for the container. By default, the
										valid values that are listed earlier are log drivers that
										the Amazon ECS container agent can communicate with.
									
For tasks that use the Fargate launch type,
										the supported log drivers are awslogs,
											splunk, and
										awsfirelens.
									
For tasks that use the EC2
										launch type, the supported log drivers are
											awslogs, fluentd,
											gelf, json-file,
											journald,
											logentries,syslog,
											splunk, and
										awsfirelens.
									
For more information about how to use the
											awslogs log driver in task definitions to
										send your container logs to CloudWatch Logs, see Using the awslogs log driver.
									
For more information about using the
											awsfirelens log driver, see Custom Log Routing.
									
Note




    
If you have a custom driver that isn't listed, you can
											fork the Amazon ECS container agent project that's available on GitHub and customize it to
											work with that driver. We encourage you to submit pull
											requests for changes that you want to have included.
											However, we don't currently support running modified
											copies of this software.
									
This parameter requires version 1.18 of the Docker Remote API or greater on your container instance.
								
options
									
Type: String to string map
									
Required: No
									
The key/value map of configuration options to send to the
										log driver.
									
When you use FireLens to route logs to an AWS service or
										AWS Partner Network destination for log storage and analytics, you can
										set the log-driver-buffer-limit option to limit
										the number of events that are buffered in memory, before
										being sent to the log router container. It can help to
										resolve potential log loss issue because high throughput
										might result in memory running out for the buffer inside of
											Docker. For more information, see Fluentd buffer limit.
									
This parameter requires version 1.19 of the Docker Remote API or greater on your container instance.
								
secretOptions
									
Type: Object array
									
Required: No
									
An object that represents the secret to pass to the log
										configuration. Secrets that are used in log configuration
										can include an authentication token, certificate, or
										encryption key. For more information, see Passing sensitive data to an Amazon ECS
				container.
						
Type: FirelensConfiguration Object
						
Required: No
						
The FireLens configuration for the container. This is used to specify
							and configure a log router for container logs. For more information, see
								Using custom log routing.
    "firelensConfiguration": {
        "type": "fluentd",
        "options": {
            "KeyName": ""
									
Type: String to string map
									
Required: No
									
The key/value map of options to use when configuring the
										log router. This field is optional and can be used to
										specify a custom configuration file or to add additional
										metadata, such as the task, task definition, cluster, and
										container instance details to the log event. If specified,
										the syntax to use is
											"options":{"enable-ecs-log-metadata":"true|false","config-file-type:"s3|file","config-file-value":"arn:aws:s3:::mybucket/fluent.conf|filepath"}.
										For more information, see Specifying a FireLens configuration in a task definition.
									
Type: String
									
Required: Yes
									
The log router to use. The valid values are
											fluentd or fluentbit.
			
Security
			
For more information about container security, see Task
					and container security in the Amazon ECS Best Practices
					Guide.
						
Required: No
						
A list of ARNs in SSM or Amazon S3 to a credential spec
								(CredSpec) file that configures the container for
							Active Directory authentication. We recommend that you use this
							parameter instead of the dockerSecurityOptions. The maximum
							number of ARNs is 1.
						
There are two formats for each ARN.
									
You use credentialspecdomainless:MyARN to
										provide a CredSpec with an additional section
										for a secret in Secrets Manager. You provide the login credentials to
										the domain in the secret.
									
Each task that runs on any container instance can join
										different domains.
									
You can use this format without joining the container
										instance to a domain.
								
credentialspec:MyARN
									
You use credentialspec:MyARN to provide a
											CredSpec for a single domain.
									
You must join the container instance to the domain before
										you start any tasks that use this task definition.
						
In both formats, replace MyARN with the ARN in SSM or
							Amazon S3.
						
The credspec must provide a ARN in Secrets Manager for a secret
							containing the username, password, and the domain to connect to. For
							better security, the instance isn't joined to the domain for domainless
							authentication. Other applications on the instance can't use the
							domainless credentials. You can use this parameter to run tasks on the
							same instance, even it the tasks need to join different domains. For
							more information, see Using gMSAs
								for Windows Containers and Using gMSAs
								for Linux Containers.
					
privileged
						
Type: Boolean
						
Required: No
						
When this parameter is true, the container is given elevated
							privileges on the host container instance (similar to the
								root user). We recommend against running containers
							with privileged. In most cases, you can specify the exact
							privileges that you need by using the specific parameters instead of
							using privileged.
						
This parameter maps to Privileged in the
							Create a container section of the Docker Remote API and
							the --privileged option to docker run.
						
Note
This parameter is not supported for Windows containers or
                                        tasks using the Fargate launch type.
						
The default is false.
						
"privileged": true|false
						
Type: String
						
Required: No
						
The user to use inside the container. This parameter maps to
								User in the Create a container section
							of the Docker Remote API and the --user option to docker run.
						
Important
When running tasks that use the host network mode,
								don't run containers using the root user (UID
								As a security best practice, always use a non-root user.
						
You can specify the user using the following formats. If
							specifying a UID or GID, you must specify it as a positive
							integer.
						
Type: String array
						
Valid values: "no-new-privileges" | "apparmor:PROFILE" |
								"label:value" |
								"credentialspec:CredentialSpecFilePath"
						
Required: No
						
A list of strings to provide custom configuration for multiple
							security systems. For more information about valid values, see Docker Run Security Configuration. This field isn't valid
							for containers in tasks using the Fargate launch
							type.
						
For Linux tasks on EC2, this parameter
							can be used to reference custom labels for SELinux and
								AppArmor multi-level security systems.
						
For any tasks on EC2, this parameter can be used to
							reference a credential spec file that configures a container for Active
							Directory authentication. For more information, see Using gMSAs for Windows Containers on Amazon EC2 and Using gMSA for Linux Containers
            on Amazon EC2.
						
This parameter maps to SecurityOpt in the
							Create a container section of the Docker Remote API and
							the --security-opt option to docker.
						
"dockerSecurityOptions": ["string", ...]
						
Note
The Amazon ECS container agent that run on a container instance must
								register with the ECS_SELINUX_CAPABLE=true or
									ECS_APPARMOR_CAPABLE=true environment variables
								before containers that are placed on that instance can use these
								security options. For more information, see Amazon ECS container agent configuration.
						
Required: No
						
A list of ulimit values to define for a container. This
							value overwrites the default resource quota setting for the operating
							system. This parameter maps to Ulimits in the
							Create a container section of the Docker Remote API and
							the --ulimit option to docker run.
						
Amazon ECS tasks hosted on Fargate use the default
    resource limit values set by the operating system with the exception of
    the nofile resource limit parameter. The nofile resource limit sets a restriction on
    the number of open files that a container can use. On Fargate, the default
    nofile soft limit is 1024 and hard limit
    is 65535. You can set the values of both limits up to 1048576. For more information,
								see Task resource limits.
						
This parameter requires version 1.18 of the Docker Remote API or greater on your container instance.
						
Note
This parameter is not supported for Windows containers.
						
"ulimits": [
        "name": "core"|"cpu"|"data"|"fsize"|"locks"|"memlock"|"msgqueue"|"nice"|"nofile"|"nproc"|"rss"|"rtprio"|"rttime"|"sigpending"|"stack",
        "softLimit": integer,
        "hardLimit": integer
									
Type: String
									
Valid values: "core" | "cpu" | "data" | "fsize" |
											"locks" | "memlock" | "msgqueue" | "nice" | "nofile" |
											"nproc" | "rss" | "rtprio" | "rttime" | "sigpending" |
											"stack"
									
Required: Yes, when ulimits are used
									
The type of the ulimit.
								
hardLimit
									
Type: Integer
									
Required: Yes, when ulimits are used
									
The hard limit for the ulimit type.
								
softLimit
									
Type: Integer
									
Required: Yes, when ulimits are used
									
The soft limit for the ulimit type.
						
Type: String to string map
						
Required: No
						
A key/value map of labels to add to the container. This parameter maps
							to Labels in the Create a container section
							of the Docker Remote API and the --label option to docker run. 
						
This parameter requires version 1.18 of the Docker Remote API or greater on your container instance.
						
"dockerLabels": {"string": "string"
		
Other container definition
				parameters
		
The following container definition parameters can be used when registering task
			definitions in the Amazon ECS console by using the Configure via JSON
			option. For more information, see Creating a task definition using the
			console.
		
Topics
Linux parameters
Container dependency
Container timeouts
System controls
Interactive
Pseudo terminal




    

			
Linux parameters
					
linuxParameters
						
Type: LinuxParameters object
						
Required: No
						
Linux-specific options that are applied to the
							container, such as KernelCapabilities.
						
Note
This parameter isn't supported for Windows
								containers.
						
"linuxParameters": {
      "capabilities": {
        "add": ["string", ...],
        "drop": ["string", ...]
									
The Linux capabilities for the container
										that are added to or dropped
										from the default configuration provided by
											Docker. For more information about the
										default capabilities and the other available capabilities,
										see Runtime privilege and Linux capabilities in the
												Docker run
											reference. For more information about these
											Linux capabilities, see the capabilities(7) Linux manual page.
												
Type: String array
												
Valid values: "ALL" | "AUDIT_CONTROL" |
												"AUDIT_READ" | "AUDIT_WRITE" | "BLOCK_SUSPEND" |
												"CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" |
												"FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" |
												"KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN"
												| "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" |
												"NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" |
												"SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" |
												"SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" |
												"SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" |
												"SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" |
												"SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" |
												"WAKE_ALARM"
												
Required: No
												
The Linux capabilities for the
												container to add to the default configuration
												provided by Docker. This parameter
												maps to CapAdd in the
												Create a container section of the
												Docker Remote API and the --cap-add
												option to docker run.
												
Note
Tasks that are launched on Fargate only
												support adding the SYS_PTRACE kernel
												capability.
												
Type: String array
												
Valid values: "SYS_PTRACE"
												
Required: No
												
The Linux capabilities for the
												container to add to the default configuration
												that's provided by Docker. This
												parameter maps to CapAdd in the
												Create a container section of the
												Docker Remote API and the --cap-add
												option to docker run.
												
Type: String array
												
Valid values: "ALL" | "AUDIT_CONTROL" |
												"AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" |
												"DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" |
												"FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" |
												"LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" |
												"MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" |
												"NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" |
												"SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" |
												"SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" |
												"SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" |
												"SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" |
												"SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" |
												"WAKE_ALARM"
												
Required: No
												
The Linux capabilities for the
												container to remove from the default configuration
												that's provided by Docker. This
												parameter maps to CapDrop in the
												Create a container section of the
												Docker Remote API and the --cap-drop
												option to docker run.
									
Any host devices to expose to the container. This
										parameter maps to Devices in the
										Create a container section of the
										Docker Remote API and the --device option to
											docker
										run.
									
Note
The devices parameter isn't supported
											when you use the Fargate launch type, or
											Windows containers.
									
Type: Array of Device objects
									
Required: No
												
The explicit permissions to provide to the
												container for the device. By default, the
												container has permissions for read,
												write, and mknod on the
												device.
												
Type: Array of strings
												
Valid Values: read |
												write | mknod
									
Run an init process inside the container that
										forwards signals and reaps processes. This parameter maps to
										the --init option to docker run.
									
This parameter requires version 1.25 of the Docker Remote API or greater on your container instance.
								
maxSwap
									
The total amount of swap memory (in MiB) a container can
										use. This parameter is translated to the
											--memory-swap option to docker run where
										the value is the sum of the container memory plus the
											maxSwap value.
									
If a maxSwap value of 0 is
										specified, the container doesn't use swap. Accepted values
										are 0 or any positive integer. If the
											maxSwap parameter is omitted, the container
										uses the swap configuration for the container instance that
										it's running on. A maxSwap value must be set
										for the swappiness parameter to be used.
									
Note
If you're using tasks that use the
											Fargate launch type, the
												maxSwap parameter isn't
											supported.
								
sharedMemorySize
									
The value for the size (in MiB) of the
											/dev/shm volume. This parameter maps to the
											--shm-size option to docker run.
									
Note
If you're using tasks that use the
											Fargate launch type, the
												sharedMemorySize parameter isn't
											supported.
									
Type: Integer
								
swappiness
									
You can use this parameter to tune a container's memory
										swappiness behavior. A swappiness value of
											0 prevents swapping from happening unless
										required. A swappiness value of
											100 causes pages to be swapped frequently.
										Accepted values are whole numbers between 0 and
											100. If you don't specify a value, the
										default value of 60 is used. Moreover, if you
										don't specify a value for maxSwap, then this
										parameter is ignored. This parameter maps to the
											--memory-swappiness option to docker run.
									
Note
If you're using tasks that use the
											Fargate launch type, the
												swappiness parameter isn't
											supported.
If you're using tasks on Amazon Linux 2023 the
												swappiness parameter isn't
											supported.
								
tmpfs
									
The container path, mount options, and maximum size (in
										MiB) of the tmpfs mount. This parameter maps
										to the --tmpfs option to docker run.
									
Note
If you're using tasks that use the
											Fargate launch type, the
												tmpfs parameter isn't supported.
									
Type: Array of Tmpfs objects
									
Required: No
												
Required: No
												
Valid Values: "defaults" | "ro" | "rw" |
												"suid" | "nosuid" | "dev" | "nodev" | "exec" |
												"noexec" | "sync" | "async" | "dirsync" |
												"remount" | "mand" | "nomand" | "atime" |
												"noatime" | "diratime" | "nodiratime" | "bind" |
												"rbind" | "unbindable" | "runbindable" | "private"
												| "rprivate" | "shared" | "rshared" | "slave" |
												"rslave" | "relatime" | "norelatime" |
												"strictatime" | "nostrictatime" | "mode" | "uid" |
												"gid" | "nr_inodes" | "nr_blocks" |
												"mpol"
												
The maximum size (in MiB) of the
												tmpfs volume.
												
Type: Integer
												
Required: Yes
						
Type: Array of ContainerDependency objects
						
Required: No
						
The dependencies defined for container startup and shutdown. A
							container can contain multiple dependencies. When a dependency is
							defined for container startup, for container shutdown it is reversed.
							For an example, see Container
                dependency.
						
Note
If a container doesn't meet a dependency constraint or times out
								before meeting the constraint, Amazon ECS doesn't progress dependent
								containers to their next state.
						
For Amazon ECS tasks that are hosted on Amazon EC2 instances, the
							instances require at least version 1.26.0 of the container
							agent to enable container dependencies. However, we recommend using the
							latest container agent version. For information about checking your
							agent version and updating to the latest version, see Updating the Amazon ECS container agent. If
							you're using an Amazon ECS-optimized Amazon Linux AMI, your instance needs at least version
								1.26.0-1 of the ecs-init package. If your
							container instances are launched from version 20190301 or
							later, they contain the required versions of the container agent and
								ecs-init. For more information, see Amazon ECS-optimized AMI.
						
For Amazon ECS tasks that are hosted on Fargate, this parameter requires
							that the task or service uses platform version 1.3.0 or
							later (Linux) or 1.0.0
								(Windows).
						
"dependsOn": [
        "containerName": "string",
        "condition": "string"
											
START – This condition emulates
												the behavior of links and volumes today. The
												condition validates that a dependent container is
												started before permitting other containers to
												start.
											
COMPLETE – This condition
												validates that a dependent container runs to
												completion (exits) before permitting other
												containers to start. This can be useful for
												non-essential containers that run a script and then
												exit. This condition can't be set on an essential
												container.
											
SUCCESS – This condition is the
												same as COMPLETE, but it also requires
												that the container exits with a zero
												status. This condition can't be set on an essential
												container.
											
HEALTHY – This condition
												validates that the dependent container passes its
												container health check before permitting other
												containers to start. This requires that the
												dependent container has health checks configured in
												the task definition. This condition is confirmed
												only at task startup.
						
Required: No
						
Example values: 120
						
Time duration (in seconds) to wait before giving up on resolving
							dependencies for a container.
						
For example, you specify two containers in a task definition with
								containerA having a dependency on
								containerB reaching a COMPLETE,
								SUCCESS, or HEALTHY status. If a
								startTimeout value is specified for
								containerB and it doesn't reach the desired status
							within that time, then containerA doesn't start.
						
Note




    
If a container doesn't meet a dependency constraint or times out
								before meeting the constraint, Amazon ECS doesn't progress dependent
								containers to their next state.
						
For Amazon ECS tasks that are hosted on Fargate, this parameter requires that the task or
							service uses platform version 1.3.0 or later
								(Linux). The maximum value is 120 seconds.
					
stopTimeout
						
Type: Integer
						
Required: No
						
Example values: 120
						
Time duration (in seconds) to wait before the container is forcefully
							killed if it doesn't exit normally on its own.
						
For Amazon ECS tasks that are hosted on Fargate, this parameter requires
							that the task or service uses platform version 1.3.0 or
							later (Linux). If the parameter isn't specified, then the
							default value of 30 seconds is used. The maximum value is 120
							seconds.
						
For tasks that use the EC2 launch type,
							if the stopTimeout parameter isn't specified, the value set
							for the Amazon ECS container agent configuration variable
								ECS_CONTAINER_STOP_TIMEOUT is used. If neither the
								stopTimeout parameter or the
								ECS_CONTAINER_STOP_TIMEOUT agent configuration variable
							is set, the default values of 30 seconds for Linux
							containers and 30 seconds on Windows containers are used.
							Container instances require at least version 1.26.0 of the container
							agent to enable a container stop timeout value. However, we recommend
							using the latest container agent version. For information about how to
							check your agent version and update to the latest version, see Updating the Amazon ECS container agent. If
							you're using an Amazon ECS-optimized Amazon Linux AMI, your instance needs at least version
							1.26.0-1 of the ecs-init package. If your container
							instances are launched from version 20190301 or later, they
							contain the required versions of the container agent and
								ecs-init. For more information, see Amazon ECS-optimized AMI.
						
Type: SystemControl object
						
Required: No
						
A list of namespace kernel parameters to set in the container. This
							parameter maps to Sysctls in the
							Create a container section of the Docker Remote API and
							the --sysctl option to docker run. For example, you can
							configure net.ipv4.tcp_keepalive_time setting to maintain
							longer lived connections.
						
We don't recommend that you specify network-related
								systemControls parameters for multiple containers in a
							single task that also uses either the awsvpc or
								host network mode. Doing this has the following
							disadvantages:
								
For tasks that use the awsvpc network mode
									including Fargate, if you set systemControls for
									any container, it applies to all containers in the task. If you
									set different systemControls for multiple
									containers in a single task, the container that's started last
									determines which systemControls take effect.
								
For tasks that use the host network mode, the
									network namespace systemControls aren't
									supported.
						
If you're setting an IPC resource namespace to use for the containers
							in the task, the following conditions apply to your system controls. For
							more information, see IPC mode.
								
For tasks that use the task IPC mode, IPC
									namespace systemControls values apply to all
									containers within a task.
						
Note
This parameter is not supported for Windows containers.
Note
This parameter is only supported for tasks that are hosted on
        AWS Fargate if the tasks are using platform version 1.4.0 or later
        (Linux). This isn't supported for Windows containers on
        Fargate.
						
"systemControls": [
         "namespace":"string",
         "value":"string"
									
The namespace kernel parameter to set a
											value for.
									
Valid IPC namespace values: "kernel.msgmax" |
											"kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" |
											"kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" |
											"kernel.shm_rmid_forced", and
											Sysctls that start with
											"fs.mqueue.*"
									
Valid network namespace values: Sysctls that
										start with "net.*"
									
All of these values are supported by
										Fargate.
								
value
									
Type: String
									
Required: No
									
The value for the namespace kernel parameter that's
										specified in namespace.
						
Required: No
						
When this parameter is true, you can deploy containerized
							applications that require stdin or a tty to be
							allocated. This parameter maps to OpenStdin in the
							Create a container section of the Docker Remote API and
							the --interactive option to docker run.
						
The default is false.
						
Required: No
						
When this parameter is true, a TTY is allocated. This
							parameter maps to Tty in the
							Create a container section of the Docker Remote API and
							the --tty option to docker run.
						
The default is false.
        
Elastic Inference accelerator
        
Note
Starting April 15, 2023, AWS will not onboard new customers to Amazon Elastic Inference (EI), and will help current customers migrate their workloads to options that offer better price and performance. After April 15, 2023, new customers will not be able to launch instances with Amazon EI accelerators in Amazon SageMaker, Amazon ECS, or Amazon EC2. However, customers who have used Amazon EI at least once during the past 30-day period are considered current customers and will be able to continue using the service. 
        
The Elastic Inference accelerator resource requirement for your task definition. For
            more information, see What Is
                Amazon Elastic Inference? in the Amazon Elastic Inference Developer Guide.
        
The following parameters are allowed in a task definition:
                    
Required: Yes
                    
The Elastic Inference accelerator device name. The deviceName
                        must also be referenced in a container definition see Elastic Inference
							accelerator.
                
deviceType
                    
Type: String
                    
Required: Yes
                    
The Elastic Inference accelerator to use.
        
Task placement constraints
        
When you register a task definition, you can provide task placement constraints that
            customize how Amazon ECS places tasks.
        
If you're using the Fargate launch type, task placement constraints
            aren't supported. By default Fargate tasks are spread across Availability
            Zones.
        
For tasks that use the EC2 launch type, you can use constraints to place
            tasks based on Availability Zone, instance type, or custom attributes. For more
            information, see Define which container
            instances Amazon ECS uses for tasks.
        
The following parameters are allowed in a container definition:
                    
Type: String
                    
Required: No
                    
A cluster query language expression to apply to the constraint. For more
                        information, see Create expressions to define container instances for Amazon ECS tasks.
                    
Type: String
                    
Required: Yes
                    
The type of constraint. Use memberOf to restrict the
                        selection to a group of valid candidates.
        
Proxy configuration
                
proxyConfiguration
                    
Type: ProxyConfiguration object
                    
Required: No
                    
The configuration details for the App Mesh proxy.
                    
For tasks that use the EC2 launch type, the
                        container instances require at least version 1.26.0 of the container agent
                        and at least version 1.26.0-1 of the ecs-init package to enable
                        a proxy configuration. If your container instances are launched from the
                        Amazon ECS-optimized AMI version 20190301 or later, then they
                        contain the required versions of the container agent and
                            ecs-init. For more information, see Amazon ECS-optimized AMI.
                    
For tasks that use the Fargate launch type, this feature
                        requires that the task or service uses platform version 1.3.0 or
                        later.
                    
Note
This parameter is not supported for Windows containers.
                    
"proxyConfiguration": {
    "type": "APPMESH",
    "containerName": "string",
    "properties": [
           "name": "string",
           "value": "string"
                                
Type: Array of KeyValuePair objects
                                
Required: No
                                
The set of network configuration parameters to provide the
                                    Container Network Interface (CNI) plugin, specified as key-value
                                    pairs.
                                        
IgnoredUID – (Required) The user ID
                                            (UID) of the proxy container as defined by the
                                                user parameter in a container
                                            definition. This is used to ensure the proxy ignores its
                                            own traffic. If IgnoredGID is specified,
                                            this field can be empty.
                                        
IgnoredGID – (Required) The group
                                            ID (GID) of the proxy container as defined by the
                                                user parameter in a container
                                            definition. This is used to ensure the proxy ignores its
                                            own traffic. If IgnoredUID is specified,
                                            this field can be empty.
                                        
AppPorts – (Required) The list of
                                            ports that the application uses. Network traffic to
                                            these ports is forwarded to the
                                                ProxyIngressPort and
                                                ProxyEgressPort.
                                        
ProxyIngressPort – (Required)
                                            Specifies the port that incoming traffic to the
                                                AppPorts is directed to.
                                        
ProxyEgressPort – (Required)
                                            Specifies the port that outgoing traffic from the
                                                AppPorts is directed to.
                                        
EgressIgnoredPorts – (Required) The
                                            outbound traffic going to these specified ports is
                                            ignored and not redirected to the
                                                ProxyEgressPort. It can be an empty
                                            list.
                                        
EgressIgnoredIPs – (Required) The
                                            outbound traffic going to these specified IP addresses
                                            is ignored and not redirected to the
                                                ProxyEgressPort. It can be an empty
                                            list.
        
Volumes
        
When you register a task definition, you can optionally specify a list of volumes to
            be passed to the Docker daemon on a container instance, which then
            becomes available for access by other containers on the same container instance.
        
The following are the types of data volumes that can be used:
                
Amazon EBS volumes — Provides cost-effective, durable, high-performance block
                    storage for data intensive containerized workloads. You can attach 1 Amazon EBS volume per Amazon ECS task when running a standalone task, or when creating or updating a
                    service. Amazon EBS volumes are supported for Linux tasks hosted on Fargate or Amazon EC2
                    instances. For more information, see Amazon EBS volumes.
                
Amazon EFS volumes — Provides simple, scalable, and persistent file storage for
                    use with your Amazon ECS tasks. With Amazon EFS, storage capacity is elastic. It grows and
                    shrinks automatically as you add and remove files. Your applications can have the
                    storage that they need and when they need it.  Amazon EFS volumes
                        are supported for tasks that are hosted on Fargate or Amazon EC2
                        instances. For more information, see Amazon EFS volumes.
                
FSx for Windows File Server volumes — Provides fully managed Microsoft Windows file
                    servers. These file servers are backed by a Windows file system. When using
                    FSx for Windows File Server together with Amazon ECS, you can provision your Windows tasks with
                    persistent, distributed, shared, and static file storage. For more information, see
                    FSx for Windows File Server volumes.
                
Windows containers on Fargate do not support this option.
                
Docker volumes – A Docker-managed volume that is created under
                    /var/lib/docker/volumes on the host Amazon EC2 instance. Docker volume
                    drivers (also referred to as plugins) are used to integrate the volumes with
                    external storage systems, such as Amazon EBS. The built-in local volume
                    driver or a third-party volume driver can be used. Docker volumes are supported only
                    when running tasks on Amazon EC2 instances. Windows containers support only the
                    use of the local driver. To use Docker volumes, specify a
                    dockerVolumeConfiguration in your task definition. For more
                    information, see Using
                        volumes.
                
Bind mounts – A file or directory on the host machine that is mounted into a
                    container. Bind mount host volumes are supported when running tasks on either AWS Fargate or Amazon EC2 instances. 
                    To use bind mount host volumes, specify a host and optional sourcePath value in
                    your task definition. For more information, see Using bind
                        mounts.
        
For more information, see Using data volumes in tasks.
        
The following parameters are allowed in a container definition.
                        
Type: String
                        
Required: No
                        
The name of the volume. Up to 255 letters (uppercase and lowercase),
                            numbers, hyphens (-), and underscores (_) are allowed. This name is referenced
                            in the sourceVolume parameter of the container definition
                                mountPoints object.
        
Required: No
        
The host parameter is used to tie the lifecycle of the bind 
            mount to the host Amazon EC2 instance, rather than the task, and where it
            is stored. If the host parameter is empty, then the Docker
            daemon assigns a host path for your data volume, but the data is not
            guaranteed to persist after the containers associated with it stop
            running.
        
Windows containers can mount whole directories on the same drive as
            $env:ProgramData.
         
Note




    
The sourcePath parameter is supported only when using tasks that are hosted on Amazon EC2 instances.
                
sourcePath
                    
Type: String
                    
Required: No
                    
When the host parameter is used, specify a
                        sourcePath to declare the path on the host
                        Amazon EC2 instance that is presented to the container. If
                        this parameter is empty, then the Docker daemon assigns
                        a host path for you. If the host parameter
                        contains a sourcePath file location, then the
                        data volume persists at the specified location on the host
                        Amazon EC2 instance until you delete it manually. If the
                        sourcePath value does not exist on the host
                        Amazon EC2 instance, the Docker daemon creates it. If the
                        location does exist, the contents of the source path folder
                        are exported.
                    
Type: Boolean
                    
Required: No
                    
Specifies whether a volume is configurable at launch. When set to
                            true, you can configure the volume when running a
                        standalone task, or when creating or updating a service. When set to
                            true, you won't be able to provide another volume
                        configuration in the task definition. This parameter must be set to
                            true to configure an Amazon EBS volume for attachment to a task.
                        Setting configuredAtLaunch to true and deferring
                        volume configuration to the launch phase allows you to create task
                        definitions that aren't constrained to a volume type or to specific volume
                        settings. Doing this makes your task definition reusable across different
                        execution environments. For more information, see Amazon EBS
                            volumes.
    
dockerVolumeConfiguration
        
Type: DockerVolumeConfiguration Object
        
Required: No
        
This parameter is specified when using Docker volumes. Docker volumes are 
            supported only when running tasks on EC2 instances. Windows containers support only
            the use of the local driver. To use bind mounts, specify a
                host instead.
                    
Valid Values: task | shared
                    
Required: No
                    
The scope for the Docker volume, which determines its lifecycle. Docker volumes that are scoped to a task are
    automatically provisioned when the task starts and destroyed when the task stops. Docker volumes
    that are scoped as shared persist after the task stops.
                
autoprovision
                    
Type: Boolean
                    
Default value: false
                    
Required: No
                    
If this value is true, the Docker volume is created if it
                        doesn't already exist. This field is used only if the scope is
                            shared. If the scope is task, then
                        this parameter must either be omitted or set to false.
                
driver
                    
Type: String
                    
Required: No
                    
The Docker volume driver to use. The driver value must match the driver
                        name provided by Docker because this name is used for task placement. If the driver
                        was installed by using the Docker plugin CLI, use docker plugin ls
                        to retrieve the driver name from your container instance. If the driver was
                        installed by using another method, use Docker plugin discovery to retrieve the
                        driver name. For more information, see Docker plugin discovery. This parameter maps to
                            Driver in the Create a
                            volume section of the Docker Remote API and the
                            --driver option to docker volume create.
                
driverOpts
                    
Type: String
                    
Required: No
                    
A map of Docker driver-specific options to pass through. This parameter
                        maps to DriverOpts in the Create a
                            volume section of the Docker Remote API and the
                            --opt option to docker volume create.
                
labels
                    
Type: String
                    
Required: No
                    
Custom metadata to add to your Docker volume. This parameter maps to
                            Labels in the Create a
                            volume section of the Docker Remote API and the
                            --label option to docker volume create.
                                        
Required: No
                                        
The directory within the Amazon EFS file system to mount as
                                            the root directory inside the host. If this parameter is
                                            omitted, the root of the Amazon EFS volume will be used.
                                            Specifying / has the same effect as
                                            omitting this parameter.
                                        
Important
If an EFS access point is specified in the
                                                  authorizationConfig, the root
                                                directory parameter must either be omitted or set to
                                                  /, which will enforce the path set on
                                                the EFS access point.
                                    
transitEncryption
                                        
Type: String
                                        
Valid values: ENABLED |
                                                DISABLED
                                        
Required: No
                                        
Specifies whether to enable encryption for Amazon EFS data in
                                            transit between the Amazon ECS host and the Amazon EFS server.
                                            If Amazon EFS IAM authorization is used, transit encryption must 
                                            be enabled. If this parameter is omitted, the
                                            default value of DISABLED is used. For more
                                            information, see Encrypting Data in Transit in the
                                                Amazon Elastic File System User Guide.
                                    
transitEncryptionPort
                                        
Type: Integer
                                        
Required: No
                                        
The port to use when sending encrypted data between
                                            the Amazon ECS host and the Amazon EFS server. If you don't
                                            specify a transit encryption port, the task will use the port
                                            selection strategy that the Amazon EFS mount helper uses. For
                                            more information, see EFS Mount
                                                Helper in the
                                                Amazon Elastic File System User Guide.
                                    
authorizationConfig
                                        
Type: EFSAuthorizationConfiguration Object
                                        
Required: No
                                        
The authorization configuration details for the Amazon EFS
                                            file system.
                                                  
Required: No
                                                  
The access point ID to use. If an access
                                                  point is specified, the root directory value in
                                                  the efsVolumeConfiguration must
                                                  either be omitted or set to /, which
                                                  will enforce the path set on the EFS access point.
                                                  If an access point is used, transit encryption
                                                  must be enabled in the
                                                  EFSVolumeConfiguration. For more
                                                  information, see Working
                                                  with Amazon EFS Access Points in the
                                                  Amazon Elastic File System User Guide.
                                                  
Type: String
                                                  
Valid values: ENABLED |
                                                  DISABLED
                                                  
Required: No
                                                  
Specifies whether to use the Amazon ECS task IAM
                                                  role that's defined in a task definition when mounting
                                                  the Amazon EFS file system. If enabled, transit
                                                  encryption must be enabled in the
                                                  EFSVolumeConfiguration. If this
                                                  parameter is omitted, the default value of
                                                  DISABLED is used. For more
                                                  information, see IAM Roles for Tasks.
                
FSxWindowsFileServerVolumeConfiguration
                    
Type: FSxWindowsFileServerVolumeConfiguration Object
                    
Required: Yes
                    
This parameter is specified when you're using an Amazon FSx for Windows File Server file system for task storage.
                                
Type: String
                                
Required: Yes
                                
The directory within the FSx for Windows File Server file system to mount as the root directory inside the
                                    host.
                            
authorizationConfig
                                            
Amazon Resource Name (ARN) of an AWS Secrets Manager secret.
ARN of an AWS Systems Manager parameter.

                                        
domain
  
                                            
Type: String
                                            
Required: Yes
                                            
A fully qualified domain name hosted by an AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) directory or a self-hosted EC2 Active Directory.
        
When you register a task definition, you can optionally specify metadata tags that are
            applied to the task definition. Tags help you categorize and organize your task
            definition. Each tag consists of a key and an optional value. You define both of them.
            For more information, see  Amazon ECS resource tagging.
        
Important
Don't add personally identifiable information or other confidential or sensitive
                information in tags. Tags are accessible to many AWS services, including billing.
                Tags aren't intended to be used for private or sensitive data.
        
The following parameters are allowed in a tag object.
                    
Type: String
                    
Required: No
                    
One part of a key-value pair that make up a tag. A key is a general label
                        that acts like a category for more specific tag values.
                
value
                    
Type: String
                    
Required: No
                    
The optional part of a key-value pair that make up a tag. A value acts as
                        a descriptor within a tag category (key).
        
Other task definition parameters
        
The following task definition parameters can be used when registering task definitions
            in the Amazon ECS console by using the Configure via JSON option. For
            more information, see Creating a task definition using the
			console.
        
Topics
Ephemeral storage
IPC mode
PID mode
            
Ephemeral storage
                    
ephemeralStorage
                        
Type: EphemeralStorage object
                        
Required: No
                        
The amount of ephemeral storage (in GB) to allocate for the task. This
                            parameter is used to expand the total amount of ephemeral storage
                            available, beyond the default amount, for tasks that are hosted on
                            AWS Fargate. For more information, see Bind mounts.
                        
Note
This parameter is only supported for tasks that are hosted on
                                AWS Fargate using platform version 1.4.0 or later
                                (Linux) or 1.0.0 or later (Windows).
                        
Type: String
                        
Required: No
                        
The IPC resource namespace to use for the containers in the task. The
                            valid values are host, task, or
                                none. If host is specified, then all the
                            containers that are within the tasks that specified the
                                host IPC mode on the same container instance share the
                            same IPC resources with the host Amazon EC2 instance. If task is
                            specified, all the containers that are within the specified task share
                            the same IPC resources. If none is specified, then IPC
                            resources within the containers of a task are private and not shared
                            with other containers in a task or on the container instance. If no
                            value is specified, then the IPC resource namespace sharing depends on
                            the Docker daemon setting on the container instance. For more
                            information, see IPC settings in the Docker run
                                reference.
                        
If the host IPC mode is used, there's a heightened risk
                            of undesired IPC namespace exposure. For more information, see Docker
                                security.
                        
If you're setting namespaced kernel parameters that use
                                systemControls for the containers in the task, the
                            following applies to your IPC resource namespace. For more information,
                            see System controls.
                                
For tasks that use the host IPC mode, IPC
                                    namespace that's related systemControls aren't
                                    supported.
                                
For tasks that use the task IPC mode,
                                        systemControls that relate to the IPC namespace
                                    apply to all containers within a task.
            
Note
This parameter is not supported for Windows containers or
                                        tasks using the Fargate launch type.
            
PID mode
                    
pidMode
                        
Type: String
                        
Valid Values: host | task
                        
Required: No
                        
The process namespace to use for the containers in the task. The valid
                            values are host or task. On Fargate for
                            Linux containers, the only valid value is task. For
                            example, monitoring sidecars might need pidMode to access
                            information about other containers running in the same task.
                        
If host is specified, all containers within the tasks
                            that specified the host PID mode on the same container
                            instance share the same process namespace with the host Amazon EC2
                            instance.
                        
If task is specified, all containers within the specified
                            task share the same process namespace.
                        
If no value is specified, the default is a private namespace for each
                            container. For more information, see PID settings in the Docker run
                                reference.
                        
If the host PID mode is used, there's a heightened risk
                            of undesired process namespace exposure. For more information, see
                                Docker security.
            
Note
This parameter is not supported for Windows containers.
Note
This parameter is only supported for tasks that are hosted on