Production ECS clusters running with Container Insights switched off

Why a cost tool cares about missing observability

Rightsizing is only as good as the task-level data behind it. A cluster without Container Insights publishes none of the per-task CPU, memory, and network series, which blinds both troubleshooting and any later rightsizing pass over the services it runs. The finding ships at $0 on purpose: enabling Insights adds CloudWatch ingestion cost rather than removing anything, so this is a low-severity compliance nudge, never a savings claim.

The settings probe, not a tag

Discovery calls DescribeClusters with the SETTINGS include and records the cluster’s containerInsights setting as an explicit true or false. The rule fires only on an explicit false. When the key is absent (the settings were never probed, perhaps a permission or transient failure) the rule abstains, because absence means “not probed”, not “off”. An earlier version keyed on a customer tag that no producer ever wrote and therefore could never fire; the settings value is authoritative and tags are ignored entirely.

Dev/test suppression, prod override

Container Insights bills per custom metric ingested, so recommending a paid observability add-on on a throwaway cluster adds cost off-mission. In one account audit, 58 of the 97 findings this rule produced sat on uat, sit, and perftest clusters. A dev/test-looking cluster name or a dev/test environment tag now suppresses the finding. One thing overrides the suppression: an explicit production environment tag. A cluster tagged prod gets flagged no matter how its name reads.

Inspecting a cluster’s Insights setting

aws ecs describe-clusters \
  --clusters my-cluster \
  --include SETTINGS \
  --query 'clusters[0].settings'

A containerInsights value of disabled is the state the rule reports on. An empty settings list means the account default applies, so check aws ecs list-account-settings --name containerInsights.

Turning it on where it pays for itself

Enable Container Insights under the cluster’s Monitoring settings, then give the new task-level dashboards a week before acting on them. The per-task-per-hour metric charge is real, which is exactly why the rule points at production clusters first: that is where the rightsizing decisions it unlocks are worth more than the ingestion bill.