For https://toris.io/2021/06/using-ecs-exec-with-readonlyrootfilesystem-enabled-containers/

ecs-task-definition.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "CloudFormation template that represents a task on Amazon ECS."

Parameters:
  ContainerImage:
    Type: String
    Default: "public.ecr.aws/toricls/alpine:3.13"
  ContainerImageWithWorkaround:
    Type: String
    Default: "public.ecr.aws/toricls/ecs-exec-workaround-readonly-fs-with-volumes:latest"
  Command:
    Type: CommaDelimitedList
    Default: "sleep, 1000000"
  LogGroupName:
    Type: String
    Default: /ecs/readonlyRootFilesystem

Resources:
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Volumes:
        - Name: "var-lib-amazon"
        - Name: "var-log-amazon"
      ContainerDefinitions:
        - Name: "disabled"
          ReadonlyRootFilesystem: false # disabled
          Image: !Ref ContainerImage
          Command: !Ref Command
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroupName
              awslogs-stream-prefix: "disabled-"
          Essential: true
        - Name: "enabled"
          ReadonlyRootFilesystem: true # enabled
          Image: !Ref ContainerImage
          Command: !Ref Command
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroupName
              awslogs-stream-prefix: "enabled-"
        - Name: "enabled-but-with-workaround"
          ReadonlyRootFilesystem: true # enabled
          Image: !Ref ContainerImageWithWorkaround
          Command: !Ref Command
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroupName
              awslogs-stream-prefix: "enabled-with-workaround-"
          MountPoints:
            - SourceVolume: "var-lib-amazon"
              ContainerPath: "/var/lib/amazon"
              ReadOnly: false
            - SourceVolume: "var-log-amazon"
              ContainerPath: "/var/log/amazon"
              ReadOnly: false
      Family: "ecs-exec-workaround-readonly-root-fs"
      RequiresCompatibilities:
        - "FARGATE"
        - "EC2"
      NetworkMode: awsvpc
      Cpu: 512
      Memory: 1024
      ExecutionRoleArn: !Ref ExecutionRole
      TaskRoleArn: !Ref TaskRole

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'

  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: 'ExecuteCommandPermissions'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action: [
                  "ssmmessages:CreateControlChannel",
                  "ssmmessages:OpenControlChannel",
                  "ssmmessages:CreateDataChannel",
                  "ssmmessages:OpenDataChannel"
                ]
                Resource: "*"
              - Effect: 'Allow'
                Action: [
                  "logs:CreateLogStream",
                  "logs:DescribeLogGroups",
                  "logs:DescribeLogStreams",
                  "logs:PutLogEvents"
                ]
                Resource: "*"