Check ID:
Provider: AWS
Service:
Severity: LOW
Categories:
Resource type:
ecs_task_definitions_logging_block_modeProvider: AWS
Service:
ecsSeverity: LOW
Categories:
logging, resilienceResource type:
AwsEcsTaskDefinitionWhat this check verifies
ECS task definition containers use non-blocking logging mode via thelogConfiguration.mode option on the latest active revision
Risk
Blocking log mode can stall writes to stdout/stderr, making containers unresponsive, failing health checks, and causing task restarts or startup failures if log groups/streams can’t be created. This reduces availability and may trigger cascading instability across dependent services.Recommendation
SetlogConfiguration.mode to non-blocking for all containers and size max-buffer-size to handle bursts. Keep log destinations in-Region to lower latency. Apply defense in depth: decouple application execution from logging, monitor log throughput, and design for backpressure so logging never blocks runtime.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-log-configuration.html
- https://www.amazonaws.cn/en/blog-selection/preventing-log-loss-with-non-blocking-mode-in-the-awslogs-container-log-driver/
- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html#specify-log-config
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = ecs_task_definitions_logging_block_mode. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks