aws / aws/containers-roadmap

[ECS] [request]: Expose All SecretManagers Key/Value Pairs with one Secret Configuration Entry

Open
#1,506 0 comments 19 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
We (myself and a customer I work with) would like the ability to mount _all_ key value pairs from a SecretsManager secret as individual key/value pairs.

**Which service(s) is this request for?**
This could be ECS Fargate and ECS.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

At present: we are exposing each key/value pair within a Secrets Manager manually, akin to:

```
ContainerDefinitions:
- Essential: true
Image: !Sub ${AWS::AccountId}.dkr.ecr.us-west-2.amazonaws.com/ecsservice:latest
Name: ecsservice
Secrets:
- Name: MYSQL_USERNAME
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ecsservice:mysql_username::"
- Name: MYSQL_HOSTNAME
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ecsservice:mysql_hostname::"
- Name: MYSQL_PASSWORD
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ecsservice:mysql_password::"
- Name: MYSQL_DATABASE
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ecsservice:mysql_database::"
Cpu: 512
ExecutionRoleArn: ECSServiceTaskExecutionIAMRole
Family: ecsservice
Memory: 512
```

Each time the development staff adds a key/value pair within SecretsManager, they also need to add a corresponding entry within the ECS Task Definition.

What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

We would like to do something similar to the following:

```
ContainerDefinitions:
- Essential: true
Image: !Sub ${AWS::AccountId}.dkr.ecr.us-west-2.amazonaws.com/ecsservice:latest
Name: ecsservice
Secrets:
valuesFrom: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:ecsservice
Cpu: 512
ExecutionRoleArn: ECSServiceTaskExecutionIAMRole
Family: ecsservice
Memory: 512
```

**Are you currently working around this issue?**

We currently add one "valueFrom" entry for each key/value pair and we are _considering_ exposing all secrets via a single key/value pair as a JSON object such as `ALL_SECRETS={"mysql_password":"a1b2c3d4","mysql_username":"mysqluser"}`. This (the single large JSON object) creates additional work for the application developer and is an uncommon approach.

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start with the ECS Task Definition Secrets examples and the requested Secrets Manager configuration shown in the issue. Determine how one configuration entry could expose all secret key/value pairs as individual container values; done means the requested ECS and ECS Fargate behavior is supported without manually listing each pair.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.