ECS task definition has logging on all containers

Check ID: ecs_task_definitions_logging_enabled
Provider: AWS
Service: ecs
Severity: HIGH
Categories: logging
Resource type: AwsEcsTaskDefinition

What this check verifies

Amazon ECS task definition containers specify a logging configuration with a non-null logDriver for every container in the latest active revision.

Risk

Absent container logs erode visibility, letting intrusions, data exfiltration, and configuration tampering go undetected. Missing audit trails weaken confidentiality and integrity, hinder forensics, and increase MTTR during outages, impacting availability and compliance evidence.

Recommendation

Implement centralized, tamper-resistant container logging for all tasks. Define a logDriver per container and ship logs to a managed destination with restricted access. Apply least privilege, encryption, and retention. Monitor and alert on anomalies. If using external collectors, ensure equivalent coverage and durability.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs register-task-definition --family <task-family> --container-definitions '[{"name":"<container-name>","image":"<image>","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"<log-group>","awslogs-region":"<region>"}}}]'

# ECS task definition with logging enabled for the container
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([
    {
      name  = "<example_resource_name>"
      image = "<image>"
      logConfiguration = {                 # Critical: enables container logging
        logDriver = "awslogs"             # Critical: non-null log driver passes the check
        options = {
          awslogs-group  = "<log-group>"  # Critical: CloudWatch Logs group
          awslogs-region = "<region>"
        }
      }
    }
  ])
}

# CloudFormation: ECS task definition with logging enabled for the container
Resources:
  ExampleTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Name: "<example_resource_name>"
          Image: "<image>"
          LogConfiguration:                 # Critical: ensures container has logging configured
            LogDriver: awslogs              # Critical: non-null log driver passes the check
            Options:
              awslogs-group: "<log-group>" # Critical: CloudWatch Logs group
              awslogs-region: "<region>"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS task definition logs in non-blocking mode ECS task definition has no secrets in environment variables

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires