-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(ecs): Ensure ECS containers have a logging configuration specified #5234
feat(ecs): Ensure ECS containers have a logging configuration specified #5234
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please, review my comments.
"Software and Configuration Checks/AWS Security Best Practices" | ||
], | ||
"ServiceName": "ecs", | ||
"SubServiceName": "taskDefinition", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"SubServiceName": "taskDefinition", | |
"SubServiceName": "", |
@@ -0,0 +1,34 @@ | |||
{ | |||
"Provider": "aws", | |||
"CheckID": "ecs_task_definition_containers_log_enabled", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"CheckID": "ecs_task_definition_containers_log_enabled", | |
"CheckID": "ecs_task_definitions_logging_enabled", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Put the task revision in the status extended as in ecs_task_definitions_host_namespace_not_shared
, can you do it for those checks that do not have it either, please?
…eck-to-ensure-a-logging-configuration-is-specified
…SubServiceName in metadata
…-a-logging-configuration-is-specified' of github.com:prowler-cloud/prowler into PRWLR-4311-add-new-ecs-task-definitions-check-to-ensure-a-logging-configuration-is-specified
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #5234 +/- ##
=======================================
Coverage 89.11% 89.12%
=======================================
Files 988 989 +1
Lines 30364 30387 +23
=======================================
+ Hits 27060 27083 +23
Misses 3304 3304 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👏🏼 👏🏼 👏🏼
Context
This check verifies whether the latest active Amazon ECS task definition has a logging configuration specified. The check fails if the task definition lacks the logConfiguration property or if the logDriver value is null in any container definition.
Logging helps you maintain the reliability, availability, and performance of Amazon ECS. Collecting data from task definitions provides visibility, which can help you debug processes and find the root cause of errors. If you are using a logging solution that does not have to be defined in the ECS task definition (such as a third party logging solution), you can disable this check after ensuring that your logs are properly captured and delivered.
Description
Added a new atributte
log_driver
toContainerDefinition
model in theecs_service.
Added checkecs_task_definition_containers_log_enabled
with respective unit tests.Checklist
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.