aws / aws/containers-roadmap

[ECS] [request]: Secrets in file and tmpfs support

Open
#241 8 comments 34 reactions 1 assignee Claimed by @staceywhou View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
I really enjoy the ability to have secrets made available to my container at runtime through the task definition. However, I'm not a big fan of exposing them as environment variables, as they are easily leaked (diagnostic logs, server info pages, linked containers, etc.).

I would like the ability to indicate a secret for my container, but have the secret be made available as a file (similar to Swarm secrets). My container can then pick up the value from the file. Preferably, the file is mounted in a tmpfs. I personally don't have the need to specify the target location (where in the container to drop the secret), but I imagine other apps might need a specific location.

**Which service(s) is this request for?**
This could be Fargate, ECS, or EKS.

**Are you currently working around this issue?**
Currently, I'm just using the integration as currently available, but would prefer to leverage files instead of env variables. I then would have an env variable that serves as a pointer to the file containing the secret value.

**Additional context**
Container images that leverage this approach are plentiful. One example is the `mysql` image. While I wouldn't configure a container this way, I can specify either the `MYSQL_ROOT_PASSWORD` env variable or the `MYSQL_ROOT_PASSWORD_FILE` to serve as a pointer to file containing the actual password. This feature change would help customers leverage several off-the-shelf images that already support file pointing.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.