> Instances get role data from the metadata service, but containers can't access that metadata and should access the local ECS agent instead (which has its own API).

Just a quick aside, but is this can't or shouldn't? I'm 100% positive you can use something like instance profile credentials from within a container (which loads credentials from the instance metadata service).

I think I agree that there's definitely a lot of depth to topics that should be covered here, and whether you want to go down the rabbit hole will vary based on org size and features you're using.

I'd personally prefer: 1. deep-dives into best practices for each feature as opposed to an on the surface glance. 2. enable it with examples. Include CloudFormation or Terraform scripts to set up each piece so that we actually build something. Documentation is important, but you can't learn without doing. 3. test against the security you've put in place.