ECS Exec (SSM-based shell access) should log to CloudWatch or S3

What it checks

ECS cluster: ECS Exec is configured without audit logging.

Where it applies

Terraform: aws_ecs_cluster

CloudFormation: AWS::ECS::Cluster

How to fix it

1. Add execute_command_configuration.log_configuration pointing at a CloudWatch log group or S3 bucket to audit all ECS Exec sessions.

Frameworks

• SOC 2 CC7.2

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules