Cloud watch encryption enabled

log_configuration

resource "aws_ecs_cluster" "your_cluster" {
  name = "your-${var.env}-cluster"

  configuration {
    execute_command_configuration {
      kms_key_id = aws_kms_key.cw_kms_key.arn
      logging    = "OVERRIDE" 

      log_configuration {
        cloud_watch_encryption_enabled = true
        cloud_watch_log_group_name     = aws_cloudwatch_log_group.your_cw_group.name
      }
    }
  }
}

• aws_ecs_cluster: name, containerInsights, execute_command_configuration