Check ECS Clusters for Container Insights

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListClustersAndDefaults",
      "Effect": "Allow",
      "Action": ["ecs:ListClusters", "ecs:ListAccountSettings"],
      "Resource": "*"
    },
    {
      "Sid": "DescribeClusters",
      "Effect": "Allow",
      "Action": "ecs:DescribeClusters",
      "Resource": "arn:aws:ecs:*:111122223333:cluster/*"
    },
    {
      "Sid": "ApplyOnlyToNamedClusters",
      "Effect": "Allow",
      "Action": "ecs:UpdateClusterSettings",
      "Resource": "arn:aws:ecs:us-east-1:111122223333:cluster/orders"
    }
  ]
}

// check-ecs-container-insights.ts
// Lists every ECS cluster in a Region with its containerInsights setting (disabled, enabled or enhanced),
// its service and task counts, and the account default that new clusters get. Report only, unless you pass
// --apply with an explicit list of cluster names.
// Usage: npx tsx check-ecs-container-insights.ts [--region us-east-1]
//        npx tsx check-ecs-container-insights.ts --apply --names orders,payments [--value enhanced|enabled]
import {
  DescribeClustersCommand,
  ECSClient,
  ListAccountSettingsCommand,
  UpdateClusterSettingsCommand,
  paginateListClusters,
  type Cluster,
} from "@aws-sdk/client-ecs";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const region = flag("--region") ?? process.env.AWS_REGION ?? "us-east-1";
const apply = args.includes("--apply");
const names = (flag("--names") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
const target = flag("--value") ?? "enhanced";
if (target !== "enhanced" && target !== "enabled") {
  console.error("--value must be enhanced or enabled");
  process.exit(1);
}
if (apply && names.length === 0) {
  console.error("--apply needs --names cluster-a,cluster-b (the script never changes every cluster at once)");
  process.exit(1);
}

const ecs = new ECSClient({ region });
const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

// The effective account default for the calling principal: what a new cluster gets if it sets nothing itself
async function accountDefault(): Promise<string> {
  const out = await ecs.send(new ListAccountSettingsCommand({ name: "containerInsights", effectiveSettings: true }));
  return out.settings?.[0]?.value ?? "not returned";
}

async function allClusters(): Promise<Cluster[]> {
  const arns: string[] = [];
  for await (const page of paginateListClusters({ client: ecs }, {})) arns.push(...(page.clusterArns ?? []));
  const clusters: Cluster[] = [];
  for (let i = 0; i < arns.length; i += 100) {
    // DescribeClusters takes up to 100 clusters; SETTINGS adds the containerInsights value
    const out = await ecs.send(new DescribeClustersCommand({ clusters: arns.slice(i, i + 100), include: ["SETTINGS"] }));
    clusters.push(...(out.clusters ?? []));
    for (const f of out.failures ?? []) console.error(`Could not describe ${f.arn}: ${f.reason}`);
  }
  return clusters;
}

const insightsOf = (c: Cluster): string =>
  c.settings?.find((s) => s.name === "containerInsights")?.value ?? "not set";

function finding(c: Cluster): string {
  const value = insightsOf(c);
  const busy = (c.activeServicesCount ?? 0) + (c.runningTasksCount ?? 0) > 0;
  if (value === "enhanced") return "enhanced: task and container metrics";
  if (value === "enabled") return "standard: cluster, service and task metrics";
  return busy ? "OFF on a cluster with running work" : "off (no services or tasks)";
}

async function applyChanges(): Promise<void> {
  for (const name of names) {
    try {
      const out = await ecs.send(
        new UpdateClusterSettingsCommand({ cluster: name, settings: [{ name: "containerInsights", value: target }] }),
      );
      console.log(`${name}: containerInsights is now ${out.cluster ? insightsOf(out.cluster) : "unknown"}`);
    } catch (err) {
      console.error(`${name}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
}

async function main(): Promise<void> {
  if (apply) return applyChanges();
  const [defaultValue, clusters] = await Promise.all([accountDefault(), allClusters()]);
  const rows = clusters.map((c) => ({
    Cluster: c.clusterName ?? "?",
    ContainerInsights: insightsOf(c),
    Services: c.activeServicesCount ?? 0,
    RunningTasks: c.runningTasksCount ?? 0,
    Instances: c.registeredContainerInstancesCount ?? 0,
    Finding: finding(c),
  }));
  rows.sort((a, b) => b.RunningTasks - a.RunningTasks);
  console.table(rows);
  const off = rows.filter((r) => r.Finding.startsWith("OFF")).length;
  console.log(`Account default for new clusters in ${region}: containerInsights=${defaultValue}`);
  console.log(`${rows.length} clusters: ${off} running work without Container Insights. Report only: nothing was changed.`);
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-ecs
npm install --save-dev tsx typescript @types/node

# Report
AWS_PROFILE=readonly npx tsx check-ecs-container-insights.ts --region us-east-1

# Turn on enhanced observability for two named clusters
AWS_PROFILE=platform-admin npx tsx check-ecs-container-insights.ts --region us-east-1 --apply --names orders,payments

┌─────────┬──────────┬───────────────────┬──────────┬──────────────┬───────────┬────────────────────────────────────────┐
│ (index) │ Cluster  │ ContainerInsights │ Services │ RunningTasks │ Instances │ Finding                                │
├─────────┼──────────┼───────────────────┼──────────┼──────────────┼───────────┼────────────────────────────────────────┤
│ 0       │ 'orders' │ 'disabled'        │ 4        │ 12           │ 0         │ 'OFF on a cluster with running work'   │
│ 1       │ 'batch'  │ 'enhanced'        │ 1        │ 3            │ 0         │ 'enhanced: task and container metrics' │
│ 2       │ 'dev'    │ 'not set'         │ 0        │ 0            │ 0         │ 'off (no services or tasks)'           │
└─────────┴──────────┴───────────────────┴──────────┴──────────────┴───────────┴────────────────────────────────────────┘
Account default for new clusters in us-east-1: containerInsights=enabled
3 clusters: 1 running work without Container Insights. Report only: nothing was changed.