ECS task definitions should have a logging configuration

How to fix it

• Can break clients: With awslogs, create the log group first and let the task execution role call logs:CreateLogStream and logs:PutLogEvents, or the task fails to start.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

logConfiguration.logDriver

awslogs, or another driver such as awsfirelens or splunk, in each container the finding lists

logConfiguration.options

For awslogs: awslogs-group, awslogs-region and awslogs-stream-prefix

Task definition

The new revision, on each service's Update page and in each scheduled task; running tasks keep the old one

With Terraform

resource "aws_ecs_task_definition" "this" {
  family = "example"

  container_definitions = jsonencode([{
    name  = "app"
    image = var.container_image
    logConfiguration = {
      logDriver = "awslogs"
      options = {
        "awslogs-group"         = aws_cloudwatch_log_group.this.name
        "awslogs-region"        = var.aws_region
        "awslogs-stream-prefix" = "app"
      }
    }
  }])
}