ECS Task Definition Log Configuration Should Be Enabled

More Info:

Ensure ECS task definition log configuration is enabled

Risk Level

Low

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• GDPR
• HIPAA
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of ECS Task Definition Log Configuration not being enabled in AWS Kubernetes using the AWS Management Console, follow these step-by-step instructions:

1. Login to AWS Console: Go to the AWS Management Console and log in to your AWS account.

2. Navigate to ECS Service: In the AWS Management Console, navigate to the ECS service by clicking on the “Services” dropdown menu at the top, selecting “ECS” under the “Compute” section.

3. Select Cluster: Select the ECS cluster where your task definition is located by clicking on the cluster name.

4. Choose Task Definition: In the ECS cluster dashboard, click on the “Task Definitions” tab on the left-hand side.

5. Select Task Definition: Select the specific task definition that you want to enable logging for by clicking on the task definition name.

6. Edit Task Definition: In the task definition details page, click on the “Create new revision” button to create a new revision of the task definition.

7. Configure Logging: In the task definition editor, scroll down to the “Container Definitions” section and click on the container name for which you want to enable logging.

8. Enable Logging: In the container configuration settings, scroll down to the “Log Configuration” section and click on the “Edit” button.

9. Enable Log Configuration: In the log configuration settings, select the logging driver you want to use (e.g., awslogs) from the dropdown menu and configure the log options as needed.

10. Save Changes: Click on the “Update” or “Save” button to save the changes to the task definition.

11. Update Service: If the task definition is already associated with an ECS service, you may need to update the service to use the new task definition revision with logging enabled. Click on the “Services” tab in the ECS cluster dashboard, select the service, and click on the “Update” button to update the service with the new task definition revision.

12. Verify Logging: Once the changes are saved and the service is updated, verify that logging is enabled for the ECS task by checking the CloudWatch Logs or the logging destination you configured.

By following these steps, you can successfully remediate the misconfiguration of ECS Task Definition Log Configuration not being enabled in AWS Kubernetes using the AWS Management Console.

Using CLI

To remediate the misconfiguration of ECS Task Definition Log Configuration not being enabled in AWS Kubernetes using AWS CLI, follow these steps:

1. Identify the ECS Task Definition that needs to have log configuration enabled:

   Use the following AWS CLI command to list all ECS Task Definitions in your AWS account:

   aws ecs list-task-definitions
   

   Identify the Task Definition ARN that needs to be updated.

2. Update the ECS Task Definition with log configuration enabled:

   Use the following AWS CLI command to update the ECS Task Definition with log configuration enabled:

   aws ecs update-task-definition --task-definition <TASK_DEFINITION_ARN> --container-definitions '[{"name":"<CONTAINER_NAME>","logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"<LOG_GROUP_NAME>","awslogs-region":"<AWS_REGION>","awslogs-stream-prefix":"<LOG_STREAM_PREFIX>"}}}]'
   

   Replace <TASK_DEFINITION_ARN>, <CONTAINER_NAME>, <LOG_GROUP_NAME>, <AWS_REGION>, and <LOG_STREAM_PREFIX> with the appropriate values for your ECS Task Definition.

3. Verify the log configuration is enabled:

   Use the following AWS CLI command to describe the updated ECS Task Definition and verify that the log configuration is enabled:

   aws ecs describe-task-definition --task-definition <TASK_DEFINITION_ARN>
   

   Check the output to ensure that the log configuration for the specified container is correctly configured.

By following these steps, you can remediate the misconfiguration of ECS Task Definition Log Configuration not being enabled in AWS Kubernetes using AWS CLI.

Using Python

To remediate the misconfiguration of ECS Task Definition Log Configuration not being enabled in AWS Kubernetes using Python, follow these steps:

1. Use the AWS SDK for Python (Boto3) to update the ECS Task Definition with the log configuration settings. Make sure you have the Boto3 library installed by running pip install boto3.

2. Write a Python script with the following code snippet to enable log configuration in the ECS Task Definition:

import boto3

def enable_log_configuration(task_definition_arn):
    ecs = boto3.client('ecs')

    response = ecs.describe_task_definition(taskDefinition=task_definition_arn)
    task_definition = response['taskDefinition']

    for container_definition in task_definition['containerDefinitions']:
        container_definition['logConfiguration'] = {
            'logDriver': 'awslogs',
            'options': {
                'awslogs-group': '/ecs/my-ecs-service',
                'awslogs-region': 'us-east-1',
                'awslogs-stream-prefix': 'my-ecs-service'
            }
        }

    response = ecs.register_task_definition(
        family=task_definition['family'],
        containerDefinitions=task_definition['containerDefinitions'],
        volumes=task_definition['volumes']
    )

    print(f"Log configuration enabled for ECS Task Definition: {response['taskDefinition']['taskDefinitionArn']}")

# Replace 'task_definition_arn' with the ARN of your ECS Task Definition
enable_log_configuration('task_definition_arn')

3. Replace 'task_definition_arn' in the script with the actual ARN of your ECS Task Definition that needs log configuration enabled.

4. Run the Python script in your AWS environment where the necessary IAM permissions are set up for the Boto3 client to describe and update ECS Task Definitions.

5. After running the script, the ECS Task Definition will be updated with the log configuration settings specified in the script, enabling logging for the containers in the task.

By following these steps, you can remediate the misconfiguration of ECS Task Definition Log Configuration not being enabled in AWS Kubernetes using Python.

Using Terraform

# CloudWatch Logs group that ECS containers will write to
resource "aws_cloudwatch_log_group" "ecs_task" {
  name              = "/ecs/TASK_FAMILY" # replace TASK_FAMILY with your ECS task family name
  retention_in_days = 30
}

# ECS task definition with logConfiguration enabled on containers
resource "aws_ecs_task_definition" "this" {
  family                   = "TASK_FAMILY"                 # replace with your ECS task family
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = "EXECUTION_ROLE_ARN"          # replace with your IAM role ARN
  task_role_arn            = "TASK_ROLE_ARN"               # replace with your IAM role ARN

  # Define containers with logConfiguration pointing to CloudWatch Logs
  container_definitions = jsonencode([
    {
      name      = "CONTAINER_NAME"                         # replace with your container name
      image     = "ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/REPO:TAG"
      essential = true

      portMappings = [
        {
          containerPort = 80
          hostPort      = 80
          protocol      = "tcp"
        }
      ]

      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-group         = aws_cloudwatch_log_group.ecs_task.name
          awslogs-region        = "AWS_REGION"             # replace with your AWS region, e.g., "us-east-1"
          awslogs-stream-prefix = "ecs"
        }
      }
    }
  ])
}

Updating the aws_ecs_task_definition will create a new task definition revision in ECS (as with the CLI example) but does not replace the Terraform resource itself; running services will start using the new revision according to your ECS service deployment settings.

To verify, terraform plan should show:

• Creation of aws_cloudwatch_log_group.ecs_task (if it does not already exist).
• An update to aws_ecs_task_definition.this.container_definitions adding the logConfiguration block for the container(s).