diff --git a/README.md b/README.md
index 87dc49d..86be638 100644
--- a/README.md
+++ b/README.md
@@ -537,7 +537,7 @@ This project creates and manages resources within an AWS account for infrastruct
 | <a name="input_infrastructure_ecs_cluster_pending_task_metric_lambda_log_retention"></a> [infrastructure\_ecs\_cluster\_pending\_task\_metric\_lambda\_log\_retention](#input\_infrastructure\_ecs\_cluster\_pending\_task\_metric\_lambda\_log\_retention) | Log retention for the ECS cluster pending task metric Lambda | `number` | n/a | yes |
 | <a name="input_infrastructure_ecs_cluster_publicly_avaialble"></a> [infrastructure\_ecs\_cluster\_publicly\_avaialble](#input\_infrastructure\_ecs\_cluster\_publicly\_avaialble) | Conditionally launch the ECS cluster EC2 instances into the Public subnet | `bool` | n/a | yes |
 | <a name="input_infrastructure_ecs_cluster_service_defaults"></a> [infrastructure\_ecs\_cluster\_service\_defaults](#input\_infrastructure\_ecs\_cluster\_service\_defaults) | Default values for ECS Cluster Services | <pre>object({<br/>    github_v1_source           = optional(bool, null)<br/>    github_v1_oauth_token      = optional(string, null)<br/>    codestar_connection_arn    = optional(string, null)<br/>    github_owner               = optional(string, null)<br/>    github_repo                = optional(string, null)<br/>    github_track_revision      = optional(string, null)<br/>    buildspec                  = optional(string, null)<br/>    buildspec_from_github_repo = optional(bool, null)<br/>    codebuild_environment_variables = optional(list(object({<br/>      name  = string<br/>      value = string<br/>    })), [])<br/>    ecr_scan_target_sns_topic_arn = optional(string, null)<br/>    deployment_type               = optional(string, null)<br/>    enable_cloudwatch_logs        = optional(bool, null)<br/>    cloudwatch_logs_retention     = optional(number, null)<br/>    enable_execute_command        = optional(bool, null)<br/>    deregistration_delay          = optional(number, null)<br/>    custom_policies = optional(map(object({<br/>      description = string<br/>      policy = object({<br/>        Version = string<br/>        Statement = list(object({<br/>          Action   = list(string)<br/>          Effect   = string<br/>          Resource = list(string)<br/>        }))<br/>      })<br/>    })), {})<br/>    container_entrypoint         = optional(list(string), null)<br/>    container_port               = optional(number, null)<br/>    container_volumes            = optional(list(map(string)), null)<br/>    container_extra_hosts        = optional(list(map(string)), null)<br/>    container_count              = optional(number, null)<br/>    container_heath_check_path   = optional(string, null)<br/>    container_heath_grace_period = optional(number, null)<br/>    scheduled_tasks = optional(map(object({<br/>      entrypoint          = optional(list(string), null)<br/>      schedule_expression = string<br/>    })), {})<br/>    domain_names                                  = optional(list(string), null)<br/>    enable_cloudfront                             = optional(bool, null)<br/>    cloudfront_tls_certificate_arn                = optional(string, null)<br/>    cloudfront_access_logging_enabled             = optional(bool, null)<br/>    cloudfront_bypass_protection_enabled          = optional(bool, null)<br/>    cloudfront_bypass_protection_excluded_domains = optional(list(string), null)<br/>    cloudfront_origin_shield_enabled              = optional(bool, null)<br/>    cloudfront_managed_cache_policy               = optional(string, null)<br/>    cloudfront_managed_origin_request_policy      = optional(string, null)<br/>    cloudfront_managed_response_headers_policy    = optional(string, null)<br/>    cloudfront_waf_association                    = optional(string, null)<br/>    alb_tls_certificate_arn                       = optional(string, null)<br/>  })</pre> | n/a | yes |
-| <a name="input_infrastructure_ecs_cluster_services"></a> [infrastructure\_ecs\_cluster\_services](#input\_infrastructure\_ecs\_cluster\_services) | Map of ECS Cluster Services (The key will be the service name). Values in here will override `infrastructure_ecs_cluster_service_defaults` values if set."<br/>    {<br/>      service-name = {<br/>        github\_v1\_source: Conditionally use GitHubV1 for the CodePipeline source (CodeStar will be used by default)<br/>        github\_v1\_oauth\_token: If `github_v1_source` is set to true, provide the GitHub OAuthToken here<br/>        codestar\_connection\_arn: The CodeStar Connection ARN to use in the CodePipeline source<br/>        github\_owner: The GitHub Owner of the repository to be pulled by the CodePipeline source<br/>        github\_repo: The GitHub repo name to be pulled by the CodePipeline source<br/>        github\_track\_revision: The branch/revision of the GitHub repository to be pulled by the CodePipeline source<br/>        buildspec: The filename of the buildspec to use for the CodePipeline build phase, stored within the 'codepipeline buildspec store' S3 bucket<br/>        buildspec\_from\_github\_repo: Conditionally use the 'buildspec' filename stored within the GitHub repo as the buildspec<br/>        codebuild\_environment\_variables: List of codebuild environment variable objects (eg. [{ name = "MY\_VAR", value = "foo" },{ name = "MY\_OTHER\_VAR", value = "bar"}])<br/>        ecr\_scan\_target\_sns\_topic\_arn: An SNS topic ARN to publish ECR scan results to<br/>        deployment\_type: The service deployment type - Can be one of 'rolling' or 'blue-green'<br/>        enable\_cloudwatch\_logs: Conditionally enable cloudwatch logs for the service<br/>        cloudwatch\_logs\_retention: CloudWatch log retention in days<br/>        enable\_execute\_command: Enable Amazon ECS Exec to directly interact with containers<br/>        deregistration\_delay: Amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused<br/>        custom\_policies: Map of custom policies to attach to the service task role (eg. { policy-name = { description = \"my custom policy\", policy = { Version = \"2012-10-17\", Statement = [] } } })<br/>        container\_entrypoint: The container entrypoint<br/>        container\_port: The service container port<br/>        container\_volumes: List of maps containing volume mappings eg. [ { "name" = "my-volume", "host\_path" = "/mnt/efs/my-dir", "container\_path" = "/mnt/my-dir" } ]<br/>        container\_extra\_hosts: List of maps containing extra hosts eg. [ { "hostname" = "my.host", "ip\_address" = "10.1.2.3" } ]<br/>        container\_count: Number of containers to launch for the service<br/>        container\_heath\_check\_path: Destination for the health check request<br/>        container\_heath\_grace\_period: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown<br/>        scheduled\_tasks: A map of scheduled tasks that use the same image as the service defined eg. { "name" => { "entrypoint" = ["bundle", "exec", "run\_jobs"], "schedule\_expression" = "cron(* * * * ? *)" } }<br/>        domain\_names: Domain names to assign to CloudFront aliases, and the Application Load Balancer's `host_header` condition<br/>        enable\_cloudfront: Enable cloadfront for the service<br/>        cloudfront\_tls\_certificate\_arn: Certificate ARN to attach to CloudFront - must contain the names provided in `domain_names`<br/>        cloudfront\_access\_logging\_enabled: Enable access logging for the distribution to the infrastructure S3 logs bucket<br/>        cloudfront\_bypass\_protection\_enabled: This adds a secret header at the CloudFront level, which is then checked by the ALB listener rules. Requests are only forwarded if the header matches, preventing requests going directly to the ALB.<br/>        cloudfront\_bypass\_protection\_excluded\_domains: A list of domains to exclude from the bypass protection<br/>        cloudfront\_origin\_shield\_enabled: Enable CloudFront Origin Shield<br/>        cloudfront\_managed\_cache\_policy: Conditionally specify a CloudFront Managed Cache Policy for the distribution<br/>        cloudfront\_managed\_origin\_request\_policy: Conditionally specify a CloudFront Managed Origin Request Policy for the distribution<br/>        cloudfront\_managed\_response\_headers\_policy: Conditionally specify a CloudFront Managed Response Headers Policy for the distribution<br/>        cloudfront\_waf\_association: Conditionally associate WAF created via `infrastructure_ecs_cluster_wafs` using the key of the waf configuration<br/>        alb\_tls\_certificate\_arn: Certificate ARN to attach to the Application Load Balancer - must contain the names provided in `domain_names`<br/>      }<br/>    } | <pre>map(object({<br/>    github_v1_source           = optional(bool, null)<br/>    github_v1_oauth_token      = optional(string, null)<br/>    codestar_connection_arn    = optional(string, null)<br/>    github_owner               = optional(string, null)<br/>    github_repo                = optional(string, null)<br/>    github_track_revision      = optional(string, null)<br/>    buildspec                  = optional(string, null)<br/>    buildspec_from_github_repo = optional(bool, null)<br/>    codebuild_environment_variables = optional(list(object({<br/>      name  = string<br/>      value = string<br/>    })), [])<br/>    ecr_scan_target_sns_topic_arn = optional(string, null)<br/>    deployment_type               = optional(string, null)<br/>    enable_cloudwatch_logs        = optional(bool, null)<br/>    cloudwatch_logs_retention     = optional(number, null)<br/>    enable_execute_command        = optional(bool, null)<br/>    deregistration_delay          = optional(number, null)<br/>    custom_policies = optional(map(object({<br/>      description = string<br/>      policy = object({<br/>        Version = string<br/>        Statement = list(object({<br/>          Action   = list(string)<br/>          Effect   = string<br/>          Resource = list(string)<br/>        }))<br/>      })<br/>    })), {})<br/>    container_entrypoint         = optional(list(string), null)<br/>    container_port               = optional(number, null)<br/>    container_volumes            = optional(list(map(string)), null)<br/>    container_extra_hosts        = optional(list(map(string)), null)<br/>    container_count              = optional(number, null)<br/>    container_heath_check_path   = optional(string, null)<br/>    container_heath_grace_period = optional(number, null)<br/>    scheduled_tasks = optional(map(object({<br/>      entrypoint          = list(string)<br/>      schedule_expression = string<br/>    })), null)<br/>    domain_names                                  = optional(list(string), null)<br/>    enable_cloudfront                             = optional(bool, null)<br/>    cloudfront_tls_certificate_arn                = optional(string, null)<br/>    cloudfront_access_logging_enabled             = optional(bool, null)<br/>    cloudfront_bypass_protection_enabled          = optional(bool, null)<br/>    cloudfront_bypass_protection_excluded_domains = optional(list(string), null)<br/>    cloudfront_origin_shield_enabled              = optional(bool, null)<br/>    cloudfront_managed_cache_policy               = optional(string, null)<br/>    cloudfront_managed_origin_request_policy      = optional(string, null)<br/>    cloudfront_managed_response_headers_policy    = optional(string, null)<br/>    cloudfront_waf_association                    = optional(string, null)<br/>    alb_tls_certificate_arn                       = optional(string, null)<br/>  }))</pre> | n/a | yes |
+| <a name="input_infrastructure_ecs_cluster_services"></a> [infrastructure\_ecs\_cluster\_services](#input\_infrastructure\_ecs\_cluster\_services) | Map of ECS Cluster Services (The key will be the service name). Values in here will override `infrastructure_ecs_cluster_service_defaults` values if set."<br/>    {<br/>      service-name = {<br/>        github\_v1\_source: Conditionally use GitHubV1 for the CodePipeline source (CodeStar will be used by default)<br/>        github\_v1\_oauth\_token: If `github_v1_source` is set to true, provide the GitHub OAuthToken here<br/>        codestar\_connection\_arn: The CodeStar Connection ARN to use in the CodePipeline source<br/>        github\_owner: The GitHub Owner of the repository to be pulled by the CodePipeline source<br/>        github\_repo: The GitHub repo name to be pulled by the CodePipeline source<br/>        github\_track\_revision: The branch/revision of the GitHub repository to be pulled by the CodePipeline source<br/>        buildspec: The filename of the buildspec to use for the CodePipeline build phase, stored within the 'codepipeline buildspec store' S3 bucket<br/>        buildspec\_from\_github\_repo: Conditionally use the 'buildspec' filename stored within the GitHub repo as the buildspec<br/>        codebuild\_environment\_variables: List of codebuild environment variable objects (eg. [{ name = "MY\_VAR", value = "foo" },{ name = "MY\_OTHER\_VAR", value = "bar"}])<br/>        ecr\_scan\_target\_sns\_topic\_arn: An SNS topic ARN to publish ECR scan results to<br/>        deployment\_type: The service deployment type - Can be one of 'rolling' or 'blue-green'<br/>        enable\_cloudwatch\_logs: Conditionally enable cloudwatch logs for the service<br/>        cloudwatch\_logs\_retention: CloudWatch log retention in days<br/>        enable\_execute\_command: Enable Amazon ECS Exec to directly interact with containers<br/>        deregistration\_delay: Amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused<br/>        custom\_policies: Map of custom policies to attach to the service task role (eg. { policy-name = { description = \"my custom policy\", policy = { Version = \"2012-10-17\", Statement = [] } } })<br/>        container\_entrypoint: The container entrypoint<br/>        container\_port: The service container port<br/>        container\_volumes: List of maps containing volume mappings eg. [ { "name" = "my-volume", "host\_path" = "/mnt/efs/my-dir", "container\_path" = "/mnt/my-dir" } ]<br/>        container\_extra\_hosts: List of maps containing extra hosts eg. [ { "hostname" = "my.host", "ip\_address" = "10.1.2.3" } ]<br/>        container\_count: Number of containers to launch for the service<br/>        container\_heath\_check\_path: Destination for the health check request<br/>        container\_heath\_grace\_period: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown<br/>        enable\_sidecar\_container: Launch a sidecar container that will act as a proxy for all incoming traffic<br/>        sidecar\_image: A specific Docker tag to use for the sidecar container. Defaults to nginx:stable (eg. nginx:1.27.1)<br/>        scheduled\_tasks: A map of scheduled tasks that use the same image as the service defined eg. { "name" => { "entrypoint" = ["bundle", "exec", "run\_jobs"], "schedule\_expression" = "cron(* * * * ? *)" } }<br/>        domain\_names: Domain names to assign to CloudFront aliases, and the Application Load Balancer's `host_header` condition<br/>        enable\_cloudfront: Enable CloudFront for the service<br/>        cloudfront\_tls\_certificate\_arn: Certificate ARN to attach to CloudFront - must contain the names provided in `domain_names`<br/>        cloudfront\_access\_logging\_enabled: Enable access logging for the distribution to the infrastructure S3 logs bucket<br/>        cloudfront\_bypass\_protection\_enabled: This adds a secret header at the CloudFront level, which is then checked by the ALB listener rules. Requests are only forwarded if the header matches, preventing requests going directly to the ALB.<br/>        cloudfront\_bypass\_protection\_excluded\_domains: A list of domains to exclude from the bypass protection<br/>        cloudfront\_origin\_shield\_enabled: Enable CloudFront Origin Shield<br/>        cloudfront\_managed\_cache\_policy: Conditionally specify a CloudFront Managed Cache Policy for the distribution<br/>        cloudfront\_managed\_origin\_request\_policy: Conditionally specify a CloudFront Managed Origin Request Policy for the distribution<br/>        cloudfront\_managed\_response\_headers\_policy: Conditionally specify a CloudFront Managed Response Headers Policy for the distribution<br/>        cloudfront\_waf\_association: Conditionally associate WAF created via `infrastructure_ecs_cluster_wafs` using the key of the waf configuration<br/>        alb\_tls\_certificate\_arn: Certificate ARN to attach to the Application Load Balancer - must contain the names provided in `domain_names`<br/>      }<br/>    } | <pre>map(object({<br/>    github_v1_source           = optional(bool, null)<br/>    github_v1_oauth_token      = optional(string, null)<br/>    codestar_connection_arn    = optional(string, null)<br/>    github_owner               = optional(string, null)<br/>    github_repo                = optional(string, null)<br/>    github_track_revision      = optional(string, null)<br/>    buildspec                  = optional(string, null)<br/>    buildspec_from_github_repo = optional(bool, null)<br/>    codebuild_environment_variables = optional(list(object({<br/>      name  = string<br/>      value = string<br/>    })), [])<br/>    ecr_scan_target_sns_topic_arn = optional(string, null)<br/>    deployment_type               = optional(string, null)<br/>    enable_cloudwatch_logs        = optional(bool, null)<br/>    cloudwatch_logs_retention     = optional(number, null)<br/>    enable_execute_command        = optional(bool, null)<br/>    deregistration_delay          = optional(number, null)<br/>    custom_policies = optional(map(object({<br/>      description = string<br/>      policy = object({<br/>        Version = string<br/>        Statement = list(object({<br/>          Action   = list(string)<br/>          Effect   = string<br/>          Resource = list(string)<br/>        }))<br/>      })<br/>    })), {})<br/>    container_entrypoint         = optional(list(string), null)<br/>    container_port               = optional(number, null)<br/>    container_volumes            = optional(list(map(string)), null)<br/>    container_extra_hosts        = optional(list(map(string)), null)<br/>    container_count              = optional(number, null)<br/>    container_heath_check_path   = optional(string, null)<br/>    container_heath_grace_period = optional(number, null)<br/>    enable_sidecar_container     = optional(bool, false)<br/>    sidecar_image                = optional(string, "nginx:stable")<br/>    scheduled_tasks = optional(map(object({<br/>      entrypoint          = list(string)<br/>      schedule_expression = string<br/>    })), null)<br/>    domain_names                                  = optional(list(string), null)<br/>    enable_cloudfront                             = optional(bool, null)<br/>    cloudfront_tls_certificate_arn                = optional(string, null)<br/>    cloudfront_access_logging_enabled             = optional(bool, null)<br/>    cloudfront_bypass_protection_enabled          = optional(bool, null)<br/>    cloudfront_bypass_protection_excluded_domains = optional(list(string), null)<br/>    cloudfront_origin_shield_enabled              = optional(bool, null)<br/>    cloudfront_managed_cache_policy               = optional(string, null)<br/>    cloudfront_managed_origin_request_policy      = optional(string, null)<br/>    cloudfront_managed_response_headers_policy    = optional(string, null)<br/>    cloudfront_waf_association                    = optional(string, null)<br/>    alb_tls_certificate_arn                       = optional(string, null)<br/>  }))</pre> | n/a | yes |
 | <a name="input_infrastructure_ecs_cluster_services_alb_enable_global_accelerator"></a> [infrastructure\_ecs\_cluster\_services\_alb\_enable\_global\_accelerator](#input\_infrastructure\_ecs\_cluster\_services\_alb\_enable\_global\_accelerator) | Enable Global Accelerator (GA) for the infrastructure ECS cluster services ALB. If `cloudfront_bypass_protection_enabled` is set for a service, any domain pointing towards the GA must be added to the `cloudfront_bypass_protection_excluded_domains` list. It is recommended that the GA only be used for apex domains that redirect to the domain associated with CloudFront. Ideally, apex domains would use an ALIAS record pointing towards the CloudFront distribution. | `bool` | n/a | yes |
 | <a name="input_infrastructure_ecs_cluster_services_alb_ip_allow_list"></a> [infrastructure\_ecs\_cluster\_services\_alb\_ip\_allow\_list](#input\_infrastructure\_ecs\_cluster\_services\_alb\_ip\_allow\_list) | IP allow list for ingress traffic to the infrastructure ECS cluster services ALB | `list(string)` | n/a | yes |
 | <a name="input_infrastructure_ecs_cluster_services_alb_logs_retention"></a> [infrastructure\_ecs\_cluster\_services\_alb\_logs\_retention](#input\_infrastructure\_ecs\_cluster\_services\_alb\_logs\_retention) | Retention in days for the infrasrtucture ecs cluster ALB logs | `number` | n/a | yes |
diff --git a/container-definitions/app.json.tpl b/container-definitions/app.json.tpl
index f885d68..a0b0ebf 100644
--- a/container-definitions/app.json.tpl
+++ b/container-definitions/app.json.tpl
@@ -10,7 +10,7 @@
         "tag": "${syslog_tag}"
       }
     },
-    %{else}
+    %{ else }
     %{ if cloudwatch_log_group != "" }
     "logConfiguration": {
       "logDriver": "awslogs",
@@ -39,6 +39,11 @@
         "containerPort": ${container_port}
       }
     ],
+    %{ if enable_sidecar_container },
+    "healthCheck": {
+      "command": ["CMD-SHELL", "curl -f localhost:${container_port} || exit 1]
+    },
+    %{ endif }
     %{ endif }
     %{ if environment != "[]" }
     "environment": ${environment},
@@ -63,13 +68,65 @@
     %{ if security_options != "[]" }
     "dockerSecurityOptions": ${security_options},
     %{ endif }
-    %{if entrypoint != "[]"}
+    %{ if entrypoint != "[]" }
     "entrypoint": ${entrypoint},
     %{ endif }
-    %{if command != "[]"}
+    %{ if command != "[]" }
     "command": ${command},
     %{ endif }
     "memoryReservation": 16,
     "essential": true
   }
+  {% if enable_sidecar_container },
+  {
+    "image": "${sidecar_image}",
+    "name": "${sidecar_container_name}",
+    %{ if syslog_address != "" }
+    "logConfiguration": {
+      "logDriver": "syslog",
+      "options": {
+        "syslog-address": "${syslog_address}",
+        "tag": "${syslog_tag}"
+      }
+    },
+    %{ else }
+    %{ if cloudwatch_log_group != "" }
+    "logConfiguration": {
+      "logDriver": "awslogs",
+      "options": {
+        %{ if awslogs_stream_prefix != "" }
+        "awslogs-stream-prefix": "${awslogs_stream_prefix}",
+        %{ endif }
+        "awslogs-group": "${cloudwatch_log_group}",
+        "awslogs-region": "${region}"
+      }
+    },
+    %{ else }
+    "logConfiguration": {
+      "logDriver": "json-file"
+    },
+    %{ endif }
+    "portMappings": [
+      {
+        "hostPort": 0,
+        "protocol": "tcp",
+        "containerPort": 8080
+      }
+    ],
+    %{ if sidecar_environment != "[]" }
+    "environment": ${sidecar_environment},
+    %{ endif }
+    %{ if sidecar_entrypoint != "[]" }
+    "entrypoint": ${sidecar_entrypoint},
+    %{ endif }
+    "memoryReservation": 16,
+    "essential": true,
+    "dependsOn": [
+      {
+        "containerName": "${container_name}",
+        "condition": "HEALTHY"
+      }
+    ]
+  }
+  %{ endif }
 ]
diff --git a/ecs-cluster-infrastructure-datadog-agent-service.tf b/ecs-cluster-infrastructure-datadog-agent-service.tf
index 5a5d26f..e2c4324 100644
--- a/ecs-cluster-infrastructure-datadog-agent-service.tf
+++ b/ecs-cluster-infrastructure-datadog-agent-service.tf
@@ -235,12 +235,17 @@ resource "aws_ecs_task_definition" "infrastructure_ecs_cluster_datadog_agent" {
           ]
         }
       })
-      security_options      = jsonencode([])
-      syslog_address        = ""
-      syslog_tag            = ""
-      cloudwatch_log_group  = aws_cloudwatch_log_group.infrastructure_ecs_cluster_datadog_agent[0].name
-      awslogs_stream_prefix = ""
-      region                = local.aws_region
+      security_options         = jsonencode([])
+      syslog_address           = ""
+      syslog_tag               = ""
+      cloudwatch_log_group     = aws_cloudwatch_log_group.infrastructure_ecs_cluster_datadog_agent[0].name
+      awslogs_stream_prefix    = ""
+      region                   = local.aws_region
+      enable_sidecar_container = false
+      sidecar_container_name   = ""
+      sidecar_image            = ""
+      sidecar_environment      = "[]"
+      sidecar_entrypoint       = "[]"
     }
   )
 
diff --git a/ecs-cluster-infrastructure-logspout-service.tf b/ecs-cluster-infrastructure-logspout-service.tf
index 6459705..8187ffe 100644
--- a/ecs-cluster-infrastructure-logspout-service.tf
+++ b/ecs-cluster-infrastructure-logspout-service.tf
@@ -20,13 +20,18 @@ resource "aws_ecs_task_definition" "infrastructure_ecs_cluster_logspout" {
           containerPath = "/var/run/docker.sock"
         }
       ])
-      linux_parameters      = jsonencode({})
-      security_options      = jsonencode([])
-      syslog_address        = ""
-      syslog_tag            = ""
-      cloudwatch_log_group  = ""
-      awslogs_stream_prefix = ""
-      region                = local.aws_region
+      linux_parameters         = jsonencode({})
+      security_options         = jsonencode([])
+      syslog_address           = ""
+      syslog_tag               = ""
+      cloudwatch_log_group     = ""
+      awslogs_stream_prefix    = ""
+      region                   = local.aws_region
+      enable_sidecar_container = false
+      sidecar_container_name   = ""
+      sidecar_image            = ""
+      sidecar_environment      = "[]"
+      sidecar_entrypoint       = "[]"
     }
   )
 
diff --git a/ecs-cluster-infrastructure-service-scheduled-task.tf b/ecs-cluster-infrastructure-service-scheduled-task.tf
index 31de5b5..35b49a5 100644
--- a/ecs-cluster-infrastructure-service-scheduled-task.tf
+++ b/ecs-cluster-infrastructure-service-scheduled-task.tf
@@ -40,12 +40,17 @@ resource "aws_ecs_task_definition" "infrastructure_ecs_cluster_service_scheduled
       linux_parameters = jsonencode({
         initProcessEnabled = false
       })
-      security_options      = jsonencode([])
-      syslog_address        = !local.infrastructure_ecs_cluster_logspout_enabled ? local.infrastructure_ecs_cluster_syslog_docker_address : ""
-      syslog_tag            = "${local.resource_prefix}-${each.key}-{{.ID}}"
-      cloudwatch_log_group  = !local.infrastructure_ecs_cluster_logspout_enabled ? each.value["enable_cloudwatch_logs"] == true ? aws_cloudwatch_log_group.infrastructure_ecs_cluster_service[each.value["container_name"]].name : "" : ""
-      awslogs_stream_prefix = ""
-      region                = local.aws_region
+      security_options         = jsonencode([])
+      syslog_address           = !local.infrastructure_ecs_cluster_logspout_enabled ? local.infrastructure_ecs_cluster_syslog_docker_address : ""
+      syslog_tag               = "${local.resource_prefix}-${each.key}-{{.ID}}"
+      cloudwatch_log_group     = !local.infrastructure_ecs_cluster_logspout_enabled ? each.value["enable_cloudwatch_logs"] == true ? aws_cloudwatch_log_group.infrastructure_ecs_cluster_service[each.value["container_name"]].name : "" : ""
+      awslogs_stream_prefix    = ""
+      region                   = local.aws_region
+      enable_sidecar_container = false
+      sidecar_container_name   = ""
+      sidecar_image            = ""
+      sidecar_environment      = "[]"
+      sidecar_entrypoint       = "[]"
     }
   )
   execution_role_arn       = aws_iam_role.infrastructure_ecs_cluster_service_task_execution[each.value["container_name"]].arn
diff --git a/ecs-cluster-infrastructure-service.tf b/ecs-cluster-infrastructure-service.tf
index 998edc5..24732c3 100644
--- a/ecs-cluster-infrastructure-service.tf
+++ b/ecs-cluster-infrastructure-service.tf
@@ -242,12 +242,17 @@ resource "aws_ecs_task_definition" "infrastructure_ecs_cluster_service" {
       linux_parameters = each.value["enable_execute_command"] == true ? jsonencode({
         initProcessEnabled = true
       }) : "{}"
-      security_options      = jsonencode([])
-      syslog_address        = !local.infrastructure_ecs_cluster_logspout_enabled ? local.infrastructure_ecs_cluster_syslog_docker_address : ""
-      syslog_tag            = "${local.resource_prefix}-${each.key}-{{.ID}}"
-      cloudwatch_log_group  = !local.infrastructure_ecs_cluster_logspout_enabled ? each.value["enable_cloudwatch_logs"] == true ? aws_cloudwatch_log_group.infrastructure_ecs_cluster_service[each.key].name : "" : ""
-      awslogs_stream_prefix = ""
-      region                = local.aws_region
+      security_options         = jsonencode([])
+      syslog_address           = !local.infrastructure_ecs_cluster_logspout_enabled ? local.infrastructure_ecs_cluster_syslog_docker_address : ""
+      syslog_tag               = "${local.resource_prefix}-${each.key}-{{.ID}}"
+      cloudwatch_log_group     = !local.infrastructure_ecs_cluster_logspout_enabled ? each.value["enable_cloudwatch_logs"] == true ? aws_cloudwatch_log_group.infrastructure_ecs_cluster_service[each.key].name : "" : ""
+      awslogs_stream_prefix    = ""
+      region                   = local.aws_region
+      enable_sidecar_container = each.value["enable_sidecar_container"]
+      sidecar_container_name   = "${each.key}-sidecar"
+      sidecar_image            = each.value["sidecar_image"]
+      sidecar_environment      = "[]"
+      sidecar_entrypoint       = "[]"
     }
   )
   execution_role_arn       = aws_iam_role.infrastructure_ecs_cluster_service_task_execution[each.key].arn
diff --git a/rds-infrastructure-s3-backups-task-definition.tf b/rds-infrastructure-s3-backups-task-definition.tf
index 9de6eac..4a79ac3 100644
--- a/rds-infrastructure-s3-backups-task-definition.tf
+++ b/rds-infrastructure-s3-backups-task-definition.tf
@@ -168,12 +168,17 @@ resource "aws_ecs_task_definition" "infrastructure_rds_s3_backups_scheduled_task
       linux_parameters = jsonencode({
         initProcessEnabled = false
       })
-      security_options      = jsonencode([])
-      syslog_address        = ""
-      syslog_tag            = ""
-      cloudwatch_log_group  = aws_cloudwatch_log_group.infrastructure_rds_s3_backups[each.key].name
-      awslogs_stream_prefix = "${local.resource_prefix}-rds-s3-backups-${each.key}"
-      region                = local.aws_region
+      security_options         = jsonencode([])
+      syslog_address           = ""
+      syslog_tag               = ""
+      cloudwatch_log_group     = aws_cloudwatch_log_group.infrastructure_rds_s3_backups[each.key].name
+      awslogs_stream_prefix    = "${local.resource_prefix}-rds-s3-backups-${each.key}"
+      region                   = local.aws_region
+      enable_sidecar_container = false
+      sidecar_container_name   = ""
+      sidecar_image            = ""
+      sidecar_environment      = "[]"
+      sidecar_entrypoint       = "[]"
     }
   )
   execution_role_arn       = aws_iam_role.infrastructure_rds_s3_backups_task_execution[each.key].arn
diff --git a/variables.tf b/variables.tf
index d273983..cafcbf7 100644
--- a/variables.tf
+++ b/variables.tf
@@ -580,9 +580,11 @@ variable "infrastructure_ecs_cluster_services" {
         container_count: Number of containers to launch for the service
         container_heath_check_path: Destination for the health check request
         container_heath_grace_period: Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown
+        enable_sidecar_container: Launch a sidecar container that will act as a proxy for all incoming traffic
+        sidecar_image: A specific Docker tag to use for the sidecar container. Defaults to nginx:stable (eg. nginx:1.27.1)
         scheduled_tasks: A map of scheduled tasks that use the same image as the service defined eg. { "name" => { "entrypoint" = ["bundle", "exec", "run_jobs"], "schedule_expression" = "cron(* * * * ? *)" } }
         domain_names: Domain names to assign to CloudFront aliases, and the Application Load Balancer's `host_header` condition
-        enable_cloudfront: Enable cloadfront for the service
+        enable_cloudfront: Enable CloudFront for the service
         cloudfront_tls_certificate_arn: Certificate ARN to attach to CloudFront - must contain the names provided in `domain_names`
         cloudfront_access_logging_enabled: Enable access logging for the distribution to the infrastructure S3 logs bucket
         cloudfront_bypass_protection_enabled: This adds a secret header at the CloudFront level, which is then checked by the ALB listener rules. Requests are only forwarded if the header matches, preventing requests going directly to the ALB.
@@ -633,6 +635,8 @@ variable "infrastructure_ecs_cluster_services" {
     container_count              = optional(number, null)
     container_heath_check_path   = optional(string, null)
     container_heath_grace_period = optional(number, null)
+    enable_sidecar_container     = optional(bool, false)
+    sidecar_image                = optional(string, "nginx:stable")
     scheduled_tasks = optional(map(object({
       entrypoint          = list(string)
       schedule_expression = string