01 Run create-log-group command (OSX/Linux/UNIX) to create the Amazon CloudWatch Logs log group where the containers in your tasks will send the log information (the command does not produce an output):
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws logs create-log-group
--region us-east-1
--log-group-name /ecs/cc-ec2-task-definition
02 Run describe-task-definition command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the latest active revision for the task definition that you want to reconfigure as identifier parameter, to describe the container definition(s) created for the selected Amazon ECS task definition:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws ecs describe-task-definition
--region us-east-1
--task-definition "arn:aws:ecs:us-east-1:123456789012:task-definition/cc-ec2-task-definition:2"
--query 'taskDefinition.{"containerDefinitions":containerDefinitions}'
03 The command output should return the requested container definition(s):
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
{
"containerDefinitions": [
{
"environment": [],
"name": "cc-prod-container",
"mountPoints": [],
"image": "cc-repository/nginx",
"cpu": 0,
"portMappings": [
{
"protocol": "tcp",
"containerPort": 80,
"hostPort": 80
}
],
"memory": 128,
"essential": true,
"volumesFrom": []
}
]
}
04 Update the container definition(s) returned at the previous step to include the task definition family name and the "awslogs" log driver configuration (highlighted). Use the name of the Amazon CloudWatch Logs log group created earlier in the process as value for the "awslogs-group" configuration property. Save your updated container definition(s) to a JSON file named cc-log-driver-config.json:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
{
"family": "cc-ec2-task-definition",
"containerDefinitions": [
{
"environment": [],
"name": "cc-prod-container",
"mountPoints": [],
"image": "cc-repository/nginx",
"cpu": 0,
"portMappings": [
{
"protocol": "tcp",
"containerPort": 80,
"hostPort": 80
}
],
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs",
"awslogs-group": "/ecs/cc-ec2-task-definition"
}
},
"memory": 128,
"essential": true,
"volumesFrom": []
}
]
}
05 Run register-task-definition command (OSX/Linux/UNIX) using the container definition(s) updated at the previous step (i.e. cc-log-driver-config.json) as input parameters, to register a new revision of the selected Amazon ECS task definition:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws ecs register-task-definition
--region us-east-1
--cli-input-json file://cc-log-driver-config.json
06 The command output should return the metadata for the newly created task definition revision:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
{
"taskDefinition": {
"status": "ACTIVE",
"family": "cc-ec2-task-definition",
"placementConstraints": [],
"requiresAttributes": [
{
"name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
},
{
"name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
}
],
"compatibilities": [
"EC2"
],
"volumes": [],
"taskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/cc-ec2-task-definition:3",
"containerDefinitions": [
{
"environment": [],
"name": "cc-prod-container",
"mountPoints": [],
"image": "cc-repository/nginx",
"cpu": 0,
"portMappings": [
{
"protocol": "tcp",
"containerPort": 80,
"hostPort": 80
}
],
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs",
"awslogs-group": "/ecs/cc-ec2-task-definition"
}
},
"memory": 128,
"essential": true,
"volumesFrom": []
}
],
"revision": 3
}
}
07 If the selected task definition is used in a service, you must update that service to use the new version of the task definition. Run update-service command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the ECS cluster service that you want to reconfigure as identifier parameter, to update the specified ECS task definition to the latest revision. Use the --task-definition command parameter to specify the latest revision of your reconfigured task definition:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
aws ecs update-service
--region us-east-1
--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-project5-cluster
--service arn:aws:ecs:us-east-1:123456789012:service/cc-project5-cluster/cc-ec2-service
--task-definition cc-ec2-task-definition:3
--query 'service.taskDefinition'
08 The command output should return the ARN of the reconfigured Amazon ECS task definition:
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
"arn:aws:ecs:us-east-1:123456789012:task-definition/cc-ec2-task-definition:3"
09 Repeat steps no. 1 – 8 to enable and configure a log driver for each Amazon ECS task definition available in the selected AWS region
10 Change the AWS region by updating the --region command parameter value and repeat the entire remediation process for other regions.
Security 
Operational