CODEWITHSUNDEEP
devopsamazon-ecs
Clement
Clement

Reputation: 4811

Updating ECS container without disclosing task definition environment variables

I was looking at this post on how to update a container of an ecs service. It requires me to pass in a JSON file with the task definition. My only worry is that if I have this on a CI/CD platform, I will have to commit my task definition, which contains secrets in the environment variables section.

Upvotes: 0

Views: 697

Answers (1)

Rik Turnbull
Rik Turnbull

Reputation: 204

You should consider using AWS Parameter Store and chamber as described in this blog: https://aws.amazon.com/blogs/mt/the-right-way-to-store-secrets-using-parameter-store/

Briefly, the steps can be summarized as:

  1. Install chamber locally where you can run it with suitable AWS privileges.
  2. Create a KMS key named parameter_store_key.
  3. Run chamber write <service> <key> <value> to add key=value into Parameter Store (<service> is a label for your application).
  4. Assign your ECS Task an IAM Role that has permission to access the Parameter Store parameter and KMS key.
  5. Install chamber into your docker image.
  6. Update the ENTRYPOINT of your docker image to run chamber exec <service> -- yourapp.
  7. The Parameter Store parameters for <service> will now be available to your app in the environment.

Upvotes: 2

Related Questions