Guidance: Security Hub ECS.5 | ECS containers should be limited to read-only access to root filesystems

I'm running the SSM Agent within a ECS Fargate task (https://github.com/willfarrell/aws-bastion). I'm trying to update it to meet AWS Security Hub ECS.5 (ECS containers should be limited to read-only access to root filesystems) that requires the task definition to have `readonlyRootFilesystem: true`.

I've added in `/etc/amazon/ssm/seelog.xml` with the below xml to have logs store `/tmp`.

```xml

```

However, it continue to send logs to the default location (`/var/log/amazon/ssm/*.log`) instead of `/tmp/*.log`. Not sure if this is a bug or a misconfiguration on my side. Any guidance would be appreciated.

Start with the SSM Agent logging configuration at /etc/amazon/ssm/seelog.xml and compare it with the default /var/log/amazon/ssm/*.log paths when running in an ECS Fargate task with readonlyRootFilesystem enabled. Reproduce the configuration and verify whether logs are written to the requested /tmp/*.log files; done means the configured paths are honored or the required configuration guidance is documented.

Written by the indexing model from the issue text.