Secrets from SSM and Secrets Manager

Inject sensitive values securely at runtime instead of hard-coding them.

The secrets field maps an environment variable to a value stored in SSM Parameter Store or AWS Secrets Manager. ECS fetches it at task start and injects it — it never appears in the task definition.

Requirements

  • The task execution role must have permission to read the parameter or secret.
  • The valueFrom is the ARN (or SSM parameter name).

Example

Example · json
{
  "containerDefinitions": [
    {
      "name": "app",
      "image": "app:1",
      "secrets": [
        {
          "name": "DB_PASSWORD",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-AbCdEf"
        },
        {
          "name": "API_KEY",
          "valueFrom": "arn:aws:ssm:us-east-1:123456789012:parameter/prod/api-key"
        }
      ]
    }
  ]
}

When to use it

  • A backend team injects a database password from Secrets Manager into a container's DB_PASSWORD environment variable so no secret is stored in the task definition.
  • A compliance team uses SSM Parameter Store SecureString parameters to inject API keys into containers, with rotation handled outside the task definition.
  • A developer rotates a Secrets Manager secret and redeploys the ECS service so all new tasks pick up the fresh credentials without any code changes.

More examples

Inject Secret from Secrets Manager

Tells ECS to fetch the secret value from Secrets Manager at task launch and inject it as the DB_PASSWORD environment variable.

Example · json
{
  "name": "api",
  "image": "my-api:latest",
  "secrets": [
    {
      "name": "DB_PASSWORD",
      "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db/password-AbCdEf"
    }
  ]
}

Inject SSM Parameter as Secret

Injects a SecureString from SSM Parameter Store as the API_KEY environment variable, decrypted by the task execution role at launch.

Example · json
{
  "name": "worker",
  "image": "my-worker:latest",
  "secrets": [
    {
      "name": "API_KEY",
      "valueFrom": "arn:aws:ssm:us-east-1:123456789012:parameter/prod/worker/api-key"
    }
  ]
}

Grant Execution Role Access to Secret

Grants the ECS task execution role permission to read the secret; without this the task will fail to start with an access denied error.

Example · bash
aws iam attach-role-policy \
  --role-name ecsTaskExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/SecretsManagerReadWrite

# Or scope to a specific secret:
aws secretsmanager put-resource-policy \
  --secret-id prod/db/password \
  --resource-policy file://secret-policy.json

Related

ecs td env vars

Discussion

  • Be the first to comment on this lesson.