Question

0

523

Views

Update Environment Variable Secrets in an ECS Container

I am deploying a task definition for ECS that contains secrets which are passed to a running container as environment variables.

These secrets are stored in AWS Secrets Manager, and the container successfully Describes theses secrets with the correct IAM policies needed. Cool.

However, say if I were to update my secret in the Secret Manager, and change a password or something - what should I do in ECS to ensure that container gets this updated secret value?

I know that you do not need to register a new task definition, as the state has not changed - I am really looking to reboot my container.. Maybe I don't need to do anything at all?

over 4 years ago · Santiago Trujillo

1 answers

Answer question

0

Answer question

Find remote jobs

Answer 1 · 2022-06-02T14:12:19.524Z

Secrets in ECS task definitions are only injected when the container starts. For this to work you need to have an ECS agent version >=1.22.0 on the container instance.

So, in the scenario mentioned above you can use one of the following options:

Force a new deployment (This will result in secrets being fetched again)
Register a new task definition (Logically the state of the definition has infact changed, because the dependent parameters/secrets were modified - it's only that you are referring an external store which is not tightly coupled with the application code)

0

523

Update Environment Variable Secrets in an ECS Container

1 answers

0

Find remote jobs

Andres GPT