Container logging validation

[viraptor]

cfn-lint version: 0.41.0

Description of issue.

Lint request: validate container logging configuration.

I got an error when deploying:

2020-11-18 11:17:04 +1100 TaskDefinition AWS::ECS::TaskDefinition CREATE_FAILED
Invalid request provided: Create TaskDefinition:
Log driver awslogs requires options: awslogs-region, awslogs-group

It looks like this would have to be implemented as a specific check since it doesn't exist in the spec.

[PatMyron]

Could you share the failing/working template snippet as well?

[viraptor]

The resource itself - failing:

"TaskDefinition": {
  "Type": "AWS::ECS::TaskDefinition",
  "Properties": {
    "NetworkMode": "awsvpc",
    "ExecutionRoleArn": {
      "Fn::GetAtt": ["ExecutionRole", "Arn"]
    },
    "ContainerDefinitions": [
      {
        "Essential": true,
        "Image": {
          "Fn::Join": [
            "",
            [
              { "Ref": "AWS::AccountId" },
              ".dkr.ecr.",
              { "Ref": "AWS::Region" },
              ".amazonaws.com/",
              { "Ref": "ApplicationName" }
            ]
          ]
        },
        "Name": { "Ref": "ApplicationName" },
        "PortMappings": [
          {
            "ContainerPort": 4433,
            "Protocol": "tcp"
          }
        ],
        "LogConfiguration": {
          "LogDriver": "awslogs",
          "Options": {
          }
        }
      ]
    }
  }
}

Working:

"TaskDefinition": {
  "Type": "AWS::ECS::TaskDefinition",
  "Properties": {
    "NetworkMode": "awsvpc",
    "ExecutionRoleArn": {
      "Fn::GetAtt": [ "ExecutionRole", "Arn" ]
    },
    "ContainerDefinitions": [
      {
        "Essential": true,
        "Image": {
          "Fn::Join": [
            "",
            [
              { "Ref": "AWS::AccountId" },
              ".dkr.ecr.",
              { "Ref": "AWS::Region" },
              ".amazonaws.com/",
              { "Ref": "ApplicationName" }
            ]
          ]
        },
        "Name": { "Ref": "ApplicationName" },
        "PortMappings": [
          {
            "ContainerPort": 4433,
            "Protocol": "tcp"
          }
        ],
        "LogConfiguration": {
          "LogDriver": "awslogs",
          "Options": {
            "awslogs-group": "something",
            "awslogs-region": {
              "Ref": "AWS::Region"
            }
          }
        }
      ]
    }
  }
}

[kddejong]

Added a rule for v1 that will validate the log configuration when using aws logs