Skip to content

ECS  >  Structures  >  TrustedExecutionConfiguration

TrustedExecutionConfiguration

Structure Class

TrustedExecutionConfiguration dataclass

Bases: _SerdeShape

The trusted execution configuration for a task. This configuration controls the isolation mode and attestation policy. You set this configuration when you register a task definition.

Note

Trusted execution is supported only for Amazon ECS Managed Instances.

Attributes

attestation_policy class-attribute instance-attribute 
attestation_policy: str | None = ...

The base64-encoded attestation policy envelope for the task. The policy specifies which containers are allowed to run and the runtime configuration that is cryptographically attested. This parameter is required when isolationMode is CONFIDENTIAL_SANDBOX.

isolation_mode instance-attribute 
isolation_mode: str

The isolation mode for tasks that use this task definition. The isolation mode determines how a task is isolated from other tasks on the same Amazon EC2 instance.

  • SHARED: The task shares the underlying Amazon EC2 instance with other tasks. This is the default isolation mode.

  • ISOLATED_SANDBOX: The task runs in its own Nitro Sandbox, which is a lightweight virtual machine that is isolated by the Amazon Web Services Nitro System. Each task's sandbox is isolated from every other task's sandbox on the same Amazon EC2 instance, so one task can't access another task's memory or storage. For more information, see Isolated and confidential tasks in Amazon Elastic Container Service Developer Guide.

  • CONFIDENTIAL_SANDBOX: The task runs in its own Nitro Sandbox, which is a lightweight virtual machine that is isolated by the Amazon Web Services Nitro System, with cryptographic attestation. The host can't access the sandbox's memory or storage, and only the approved workload can decrypt data that you encrypt with your Key Management Service key. For more information, see Isolated and confidential tasks in Amazon Elastic Container Service Developer Guide.