# ExecuteCommandLogConfiguration

The log configuration for the results of the execute command actions.

The logs can be sent to CloudWatch Logs and/ or an Amazon S3 bucket.
For more information, see [ExecuteCommandLogConfiguration] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-executecommandlogconfiguration.html

- Source: [`aws-ecs/lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-ecs/lib/cluster.ts#L1391)
- Type last changed: v2.235.0 · 15 Jan 2026

## Example

```ts
declare const vpc: ec2.Vpc;
const kmsKey = new kms.Key(this, 'KmsKey');

// Pass the KMS key in the `encryptionKey` field to associate the key to the log group
const logGroup = new logs.LogGroup(this, 'LogGroup', {
  encryptionKey: kmsKey,
});

// Pass the KMS key in the `encryptionKey` field to associate the key to the S3 bucket
const execBucket = new s3.Bucket(this, 'EcsExecBucket', {
  encryptionKey: kmsKey,
});

const cluster = new ecs.Cluster(this, 'Cluster', {
  vpc,
  executeCommandConfiguration: {
    kmsKey,
    logConfiguration: {
      cloudWatchLogGroup: logGroup,
      cloudWatchEncryptionEnabled: true,
      s3Bucket: execBucket,
      s3EncryptionEnabled: true,
      s3KeyPrefix: 'exec-command-output',
    },
    logging: ecs.ExecuteCommandLogging.OVERRIDE,
  },
});
```

## Properties

- `cloudWatchEncryptionEnabled`: boolean — Whether or not to enable encryption on the CloudWatch logs.

  **Default:** encryption will be disabled.

- `cloudWatchLogGroup`: [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) = none — The name of the CloudWatch log group to send logs to.

  The CloudWatch log group must already be created.

- `s3Bucket`: [IBucket](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.IBucket.html) = none — The name of the S3 bucket to send logs to.

  The S3 bucket must already be created.

- `s3EncryptionEnabled`: boolean — Whether or not to enable encryption on the S3 bucket.

  **Default:** encryption will be disabled.

- `s3KeyPrefix`: string = none — An optional folder in the S3 bucket to place logs in.