Back to Checks
aws

ECS task definition has container logging in non-blocking mode

ecs_task_definitions_logging_block_mode
Service: ecsSeverity: low
OfficialBuilt-inVerified
Categories:loggingresilience
Resource Type:AwsEcsTaskDefinition

ECS task definition containers use non-blocking logging mode via the logConfiguration.mode option on the latest active revision

Prowler logoProwlerprowler-provider-aws

Risk

Blocking log mode can stall writes to stdout/stderr, making containers unresponsive, failing health checks, and causing task restarts or startup failures if log groups/streams can't be created. This reduces availability and may trigger cascading instability across dependent services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_definitions_logging_block_mode

Recommendation

Set logConfiguration.mode to non-blocking for all containers and size max-buffer-size to handle bursts. Keep log destinations in-Region to lower latency. Apply defense in depth: decouple application execution from logging, monitor log throughput, and design for backpressure so logging never blocks runtime.

Remediation

CLI

aws ecs register-task-definition --family <task-family> --container-definitions '[{"name":"<container-name>","image":"<image>","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"<log-group>","awslogs-region":"<region>","awslogs-stream-prefix":"ecs","mode":"non-blocking"}}}]'

Terraform

# ECS Task Definition with container logging set to non-blocking
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family = "<example_resource_name>"

  # CRITICAL: "mode": "non-blocking" in logConfiguration options enforces non-blocking logging
  container_definitions = jsonencode([
    {
      name  = "<example_resource_name>"
      image = "<image>"
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-group         = "<log-group>"
          awslogs-region        = "<region>"
          awslogs-stream-prefix = "ecs"
          mode                  = "non-blocking" # CRITICAL: required to pass the check
        }
      }
    }
  ])
}

NativeIaC

# CloudFormation: ECS Task Definition with non-blocking container logging
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <example_resource_name>
          Image: <image>
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: <log-group>
              awslogs-region: <region>
              awslogs-stream-prefix: ecs
              mode: non-blocking  # CRITICAL: sets logging to non-blocking to pass the check

Other

1Open the AWS Console and go to ECS > Task Definitions
2Select the failing task definition and choose Create new revision
3Edit the affected container > Log configuration
4Set Log driver to awslogs and add option: mode = non-blocking
5Ensure awslogs-group, awslogs-region, and (if needed) awslogs-stream-prefix are set
6Save and Create; the new revision will have non-blocking logging

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_definitions_logging_block_mode(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
            if task_definition.container_definitions is None:
                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
            report.resource_id = f"{task_definition.name}:{task_definition.revision}"
            containers = 0
            report.status = "PASS"
            report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} containers has logging configured with non blocking mode."
            failed_containers = []
            for container in task_definition.container_definitions:
                if container.log_driver:
                    containers = containers + 1
                    if container.log_option != "non-blocking":
                        report.status = "FAIL"
                        failed_containers.append(container.name)

            if failed_containers:
                report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} running with logging set to blocking mode on containers: {', '.join(failed_containers)}"

            if containers > 0:
                findings.append(report)
        return findings

References