Docker on Amazon Web Services

Configuring ECS task definitions to use secrets

Let's first deal with reconfiguring the ECS task definitions to use your newly created secret.  Your containers now include an entrypoint script that will retrieve secrets from AWS Secrets Manager, and before you update the various ECS task definitions to import the names of your secrets as an environment variable, you need to ensure your containers have the correct permissions to do this.  Although you could add such permissions to the ECS container instance role that is applied at an EC2 instance level, a more secure approach is to create specific IAM roles that you can assign to your containers, given you might be sharing your ECS clusters with multiple applications and don't want to grant ...