# ECS Cluster Missing Container Insights

> ZopNight flags an ECS cluster only when the cluster's own settings report Container Insights as explicitly off, and only outside dev/test environments. In one account audit, 58 of 97 findings landed on uat and perftest clusters. Missing settings data abstains, and the finding itself carries $0.

Source: https://zop.dev/integrations/aws/recommendations/ecs-cluster-missing-container-insights
Updated: 2026-08-19

---

## Why a cost tool cares about missing observability

Rightsizing is only as good as the task-level data behind it. A cluster without Container
Insights publishes none of [the per-task CPU, memory, and network series](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html), which blinds both
troubleshooting and any later rightsizing pass over the services it runs. The finding ships
at $0 on purpose: enabling Insights adds [CloudWatch ingestion cost](https://aws.amazon.com/cloudwatch/pricing/) rather than removing
anything, so this is a low-severity compliance nudge, never a savings claim.

## The settings probe, not a tag

Discovery calls `DescribeClusters` with the SETTINGS include and records the cluster's
`containerInsights` setting as an explicit true or false. The rule fires only on an explicit
false. When the key is absent (the settings were never probed, perhaps a permission or
transient failure) the rule abstains, because absence means "not probed", not "off". An
earlier version keyed on a customer tag that no producer ever wrote and therefore could
never fire; the settings value is authoritative and tags are ignored entirely.

## Dev/test suppression, prod override

Container Insights bills per custom metric ingested, so recommending a paid observability
add-on on a throwaway cluster adds cost off-mission. In one account audit, 58 of the 97
findings this rule produced sat on uat, sit, and perftest clusters. A dev/test-looking
cluster name or a dev/test environment tag now suppresses the finding. One thing overrides
the suppression: an explicit production environment tag. A cluster tagged prod gets flagged
no matter how its name reads.

## Inspecting a cluster's Insights setting

```bash
aws ecs describe-clusters \
  --clusters my-cluster \
  --include SETTINGS \
  --query 'clusters[0].settings'
```

A `containerInsights` value of `disabled` is the state the rule reports on. An empty
settings list means the account default applies, so check
`aws ecs list-account-settings --name containerInsights`.

## Turning it on where it pays for itself

Enable Container Insights under the cluster's Monitoring settings, then give the new
task-level dashboards a week before acting on them. The per-task-per-hour metric charge is
real, which is exactly why the rule points at production clusters first: that is where the
rightsizing decisions it unlocks are worth more than the ingestion bill.