Check ID: ecs_task_definitions_logging_block_mode
Provider: AWS
Service: ecs
Severity: LOW
Categories: logging, resilience
Resource type: AwsEcsTaskDefinition

What this check verifies

ECS task definition containers use non-blocking logging mode via the logConfiguration.mode option on the latest active revision

Risk

Blocking log mode can stall writes to stdout/stderr, making containers unresponsive, failing health checks, and causing task restarts or startup failures if log groups/streams can’t be created. This reduces availability and may trigger cascading instability across dependent services.

Recommendation

Set logConfiguration.mode to non-blocking for all containers and size max-buffer-size to handle bursts. Keep log destinations in-Region to lower latency. Apply defense in depth: decouple application execution from logging, monitor log throughput, and design for backpressure so logging never blocks runtime.

Remediation

aws ecs register-task-definition --family <task-family> --container-definitions '[{"name":"<container-name>","image":"<image>","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"<log-group>","awslogs-region":"<region>","awslogs-stream-prefix":"ecs","mode":"non-blocking"}}}]'

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_logging_block_mode. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks