cdk-nag icon indicating copy to clipboard operation
cdk-nag copied to clipboard

feat: error if ECS task definition includes awslogs driver running in blocking mode

Open MarrickLip opened this issue 4 months ago • 1 comments

This PR adds a new test (ECSTaskDefinitionAwslogsDriverNotBlocking) which validates whether there are containers in an ECS task definition which are using the awslogs driver in blocking mode. This is added to the AWS Solutions pack as AwsSolutions-ECS8.

Blocking mode is the default configuration, but it is not recommended [^1] [^2] for many workloads as it blocks the container if logs can't be sent to CloudWatch for any reason. This is an availability risk as many applications would rather loose logs during a CloudWatch outage etc. than take downtime.

[^1]: Trusted Advisor check: https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-ec2-awslogs-driver-blockingmode

[^2]: Blog post: https://aws.amazon.com/blogs/containers/choosing-container-logging-options-to-avoid-backpressure/

MarrickLip avatar Oct 21 '24 11:10 MarrickLip