fix(aws): retrieve correctly ECS Container insights settings (#8100)

Co-authored-by: Jack Holloway <MrPrimate@users.noreply.github.com>
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

prowler/CHANGELOG.md

@@ -36,6 +36,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### Fixed
 - `organizations_scp_check_deny_regions` check to pass when SCP policies have no statements [(#8091)](https://github.com/prowler-cloud/prowler/pull/8091)
 - Fix logic in VPC and ELBv2 checks [(#8077)](https://github.com/prowler-cloud/prowler/pull/8077)
+- Retrieve correctly ECS Container insights settings [(#8097)](https://github.com/prowler-cloud/prowler/pull/8097)
 
 ---
 

prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.py

@@ -13,11 +13,10 @@ class ecs_cluster_container_insights_enabled(Check):
             )
             if cluster.settings:
                 for setting in cluster.settings:
-                    if (
-                        setting["name"] == "containerInsights"
-                        and setting["value"] == "enabled"
+                    if setting["name"] == "containerInsights" and (
+                        setting["value"] == "enabled" or setting["value"] == "enhanced"
                     ):
                         report.status = "PASS"
-                        report.status_extended = f"ECS cluster {cluster.name} has container insights enabled."
+                        report.status_extended = f"ECS cluster {cluster.name} has container insights {setting['value']}."
             findings.append(report)
         return findings

prowler/providers/aws/services/ecs/ecs_service.py

@@ -175,6 +175,7 @@ class ECS(AWSService):
                 clusters=[cluster.arn],
                 include=[
                     "TAGS",
+                    "SETTINGS",
                 ],
             )
             cluster.settings = response["clusters"][0].get("settings", [])

tests/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled_test.py

@@ -109,6 +109,45 @@ class Test_ecs_clusters_container_insights_enabled:
                 == f"ECS cluster {CLUSTER_NAME} has container insights enabled."
             )
 
+    @mock_aws
+    def test_cluster_enhanced_container_insights(self):
+        ecs_client = client("ecs", region_name=AWS_REGION_US_EAST_1)
+        cluster_settings = [
+            {"name": "containerInsights", "value": "enhanced"},
+        ]
+        cluster_arn = ecs_client.create_cluster(
+            clusterName=CLUSTER_NAME,
+            settings=cluster_settings,
+        )["cluster"]["clusterArn"]
+
+        from prowler.providers.aws.services.ecs.ecs_service import ECS
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.ecs.ecs_cluster_container_insights_enabled.ecs_cluster_container_insights_enabled.ecs_client",
+                new=ECS(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.ecs.ecs_cluster_container_insights_enabled.ecs_cluster_container_insights_enabled import (
+                ecs_cluster_container_insights_enabled,
+            )
+
+            check = ecs_cluster_container_insights_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_arn == cluster_arn
+            assert (
+                result[0].status_extended
+                == f"ECS cluster {CLUSTER_NAME} has container insights enhanced."
+            )
+
     @mock_aws
     def test_cluster_disabled_container_insights(self):
         ecs_client = client("ecs", region_name=AWS_REGION_US_EAST_1)