[aws-ecs] Allow for field prop in ecs.Secret.fromSecretsManager for Fargate launch type

[jpSimkins]

Allow for using field values for ecs.Secret.fromSecretsManager(cdkTestSecret), for the Fargate launch type.

Currently, if you try to use the field prop, you will see this message:

Cannot specify secret JSON field for a task using the FARGATE launch type: 'DB_PASSWORD' in container '...'

Use Case

Our systems are already designed to use ENV Vars, this limitation means we need to modify the systems now to parse the json and build a way to add this into the ENV vars. Although, once inside the app, this is not as secure.

e.g. in PHP you can disable the $_ENV super global and force the usage of getenv. I cannot do this with the current limitation and this would expose the secrets to the $_ENV super global. This is not ideal but it's the fastest solution I can do to not break existing system.

Proposed Solution

Please allow the use of field from the secrets manager for Fargate launch types

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[jogold]

Unfortunately this is currently not supported by ECS for tasks that use the Fargate launch type: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-secrets.html

For tasks that use the Fargate launch type, the following should be considered:

• It is only supported to inject the full contents of a secret as an environment variable. Specifying a specific JSON key or version is not supported at this time.

[jpSimkins]

This is why this ticket is a feature request ;) Ideally, if there are enough up votes then this may possible. I get that this is a limitation with ECS currently but that doesn't mean that this feature request is not warranted.

I have numerous projects that will have to be refactored a bit to get this to work and I think that this limitation should be considered for review. Either way, I am going to have to refactor but this is not ideal for the long haul.

[jogold]

FYI this is currently tracked here aws/containers-roadmap#385

[jpSimkins]

@jogold Thank you!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[marcotesch]

This is now Possible can we make that feature available?

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-secrets.html

[jogold]

See #11348 + workaround here #11341 (comment)