Back to Checks
aws

ECS task definition has logging configured for all containers

ecs_task_definitions_logging_enabled
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsEcsTaskDefinition

Amazon ECS task definition containers specify a logging configuration with a non-null logDriver for every container in the latest active revision.

Prowler logoProwlerprowler-provider-aws

Risk

Absent container logs erode visibility, letting intrusions, data exfiltration, and configuration tampering go undetected.

Missing audit trails weaken confidentiality and integrity, hinder forensics, and increase MTTR during outages, impacting availability and compliance evidence.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_definitions_logging_enabled

Recommendation

Implement centralized, tamper-resistant container logging for all tasks. Define a logDriver per container and ship logs to a managed destination with restricted access. Apply least privilege, encryption, and retention. Monitor and alert on anomalies. If using external collectors, ensure equivalent coverage and durability.

Remediation

CLI

aws ecs register-task-definition --family <task-family> --container-definitions '[{"name":"<container-name>","image":"<image>","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"<log-group>","awslogs-region":"<region>"}}}]'

Terraform

# ECS task definition with logging enabled for the container
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([
    {
      name  = "<example_resource_name>"
      image = "<image>"
      logConfiguration = {                 # Critical: enables container logging
        logDriver = "awslogs"             # Critical: non-null log driver passes the check
        options = {
          awslogs-group  = "<log-group>"  # Critical: CloudWatch Logs group
          awslogs-region = "<region>"
        }
      }
    }
  ])
}

NativeIaC

# CloudFormation: ECS task definition with logging enabled for the container
Resources:
  ExampleTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Name: "<example_resource_name>"
          Image: "<image>"
          LogConfiguration:                 # Critical: ensures container has logging configured
            LogDriver: awslogs              # Critical: non-null log driver passes the check
            Options:
              awslogs-group: "<log-group>" # Critical: CloudWatch Logs group
              awslogs-region: "<region>"

Other

1In the AWS Console, go to Amazon ECS > Task Definitions
2Select your task definition and click Create new revision
3For each container, open Edit and set Log configuration to awslogs
4Set Log group to the desired CloudWatch Logs group and select the Region
5Save and Create to register the new revision (ensure all containers have logging)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_definitions_logging_enabled(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
            if task_definition.container_definitions is None:
                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
            report.resource_id = f"{task_definition.name}:{task_definition.revision}"
            report.status = "PASS"
            report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} containers have logging configured."
            failed_containers = []
            for container in task_definition.container_definitions:
                if not container.log_driver:
                    report.status = "FAIL"
                    failed_containers.append(container.name)

            if failed_containers:
                report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} has containers running with no logging configuration: {', '.join(failed_containers)}"

            findings.append(report)
        return findings

References