Back to Checks
aws

ECS cluster has Container Insights enabled or enhanced

ecs_cluster_container_insights_enabled
Service: ecsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsEcsCluster

ECS clusters have CloudWatch Container Insights configured via the containerInsights setting, accepting enabled or enhanced values to emit cluster, service, task, and container telemetry.

Prowler logoProwlerprowler-provider-aws

Risk

Without Container Insights, ECS operations lack telemetry to spot failures and anomalies. Missed CPU/memory/network spikes and restart loops degrade availability and delay response. Absent baselines impede detecting abuse (e.g., cryptomining or data egress bursts), risking confidentiality and unexpected costs.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_cluster_container_insights_enabled

Recommendation

Enable Container Insights on all clusters-prefer enhanced for deeper visibility. Apply at account level for new clusters and enforce via automation.

Use least privilege for access to metrics/logs, encrypt logs, and set alarms on critical metrics. Correlate with app logs and tracing for defense in depth and faster incident detection.

Remediation

CLI

aws ecs update-cluster-settings --cluster <cluster-name> --settings name=containerInsights,value=enabled

Terraform

# Terraform: Enable Container Insights on an ECS cluster
resource "aws_ecs_cluster" "<example_resource_name>" {
  name = "<example_resource_name>"

  setting {
    name  = "containerInsights"   # Critical: enables CloudWatch Container Insights for the cluster
    value = "enabled"             # Critical: setting that passes the check
  }
}

NativeIaC

# CloudFormation: Enable Container Insights on an ECS cluster
Resources:
  <example_resource_name>:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterSettings:
        - Name: containerInsights  # Critical: enables CloudWatch Container Insights for the cluster
          Value: enabled           # Critical: setting that passes the check

Other

1Open the Amazon ECS console
2Go to Clusters and select the target cluster
3Click Update cluster
4Under CloudWatch Container Insights, enable Container Insights (or Enhanced)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_cluster_container_insights_enabled(Check):
    def execute(self):
        findings = []
        for cluster in ecs_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"ECS cluster {cluster.name} does not have container insights enabled."
            )
            if cluster.settings:
                for setting in cluster.settings:
                    if setting["name"] == "containerInsights" and (
                        setting["value"] == "enabled" or setting["value"] == "enhanced"
                    ):
                        report.status = "PASS"
                        report.status_extended = f"ECS cluster {cluster.name} has container insights {setting['value']}."
            findings.append(report)
        return findings

References