ECS cluster has Container Insights enabled or enhanced

Check ID: ecs_cluster_container_insights_enabled
Provider: AWS
Service: ecs
Severity: MEDIUM
Categories: logging
Resource type: AwsEcsCluster

What this check verifies

ECS clusters have CloudWatch Container Insights configured via the containerInsights setting, accepting enabled or enhanced values to emit cluster, service, task, and container telemetry.

Risk

Without Container Insights, ECS operations lack telemetry to spot failures and anomalies. Missed CPU/memory/network spikes and restart loops degrade availability and delay response. Absent baselines impede detecting abuse (e.g., cryptomining or data egress bursts), risking confidentiality and unexpected costs.

Recommendation

Enable Container Insights on all clusters-prefer enhanced for deeper visibility. Apply at account level for new clusters and enforce via automation. Use least privilege for access to metrics/logs, encrypt logs, and set alarms on critical metrics. Correlate with app logs and tracing for defense in depth and faster incident detection.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs update-cluster-settings --cluster <cluster-name> --settings name=containerInsights,value=enabled

# Terraform: Enable Container Insights on an ECS cluster
resource "aws_ecs_cluster" "<example_resource_name>" {
  name = "<example_resource_name>"

  setting {
    name  = "containerInsights"   # Critical: enables CloudWatch Container Insights for the cluster
    value = "enabled"             # Critical: setting that passes the check
  }
}

# CloudFormation: Enable Container Insights on an ECS cluster
Resources:
  <example_resource_name>:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterSettings:
        - Name: containerInsights  # Critical: enables CloudWatch Container Insights for the cluster
          Value: enabled           # Critical: setting that passes the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_cluster_container_insights_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECR repository has image tag immutability enabled ECS Fargate service uses the latest Fargate platform version

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires