I'm trying to set RDS Aurora credentials as environment variables to an ECS Task.
Initially I'm passing it as plaintext on environments.
I know the proper way to do it is using secrets but ApplicationLoadBalancedTaskImageOptions expects a Secret and the rds.DatabaseCluster returns another type of it.
What is the correct way to manage the credentials on this case?
task_image_options=ecs_patterns.ApplicationLoadBalancedTaskImageOptions(
image=ecs.ContainerImage.from_registry("sonarqube:8.2-community"),
container_port=9000,
# FIXME: by documentation this is the right way to pass creds, however this fail, the database secret is not the same type than the expected
# secrets={
# "sonar.jdbc.password": ecs.Secret.from_secrets_manager(self.db.secret)
# },
environment={
'sonar.jdbc.url': url,
"sonar.jdbc.username": username,
"sonar.jdbc.password": self.db.secret.secret_value_from_json("password").to_string() #plaintext, FIXME
}
)
What a dejavu!
I posted an article about this topic two days ago:
Here you clearly can spot the differences between using secrets and environment variables.
If you want to pass it as a secret, you first have to store the value in either AWS SecretsManager or AWS Parameter Store. Then you pass the ARN of the secret, from one of those two services, as the value in the ECS task definition and ECS will automatically pull the real value from SecretsManager or Parameter Store when it instantiates the container. This is documented here.
If you want to consume value from the secret store then it should secrets not environment variable.
Replace environment variable with secrets like below
"secrets": [
{
"name": "MY_KEY",
"valueFrom": "arn:aws:secretsmanager:us-west-2:12345656:secret:demo-0Nlyli"
}
]
Just place the ARN and ECS will inject the value during run time.
To set the Environment variable you need
"environment": [
{
"name": "KEY",
"value": "VALUE"
}
]
so in your case
"environment": [
{
"name": "sonar.jdbc.url",
"value": "some-url"
}
]