[ECS] [request]: Secrets in file and tmpfs support
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
I really enjoy the ability to have secrets made available to my container at runtime through the task definition. However, I'm not a big fan of exposing them as environment variables, as they are easily leaked (diagnostic logs, server info pages, linked containers, etc.).
I would like the ability to indicate a secret for my container, but have the secret be made available as a file (similar to Swarm secrets). My container can then pick up the value from the file. Preferably, the file is mounted in a tmpfs. I personally don't have the need to specify the target location (where in the container to drop the secret), but I imagine other apps might need a specific location.
**Which service(s) is this request for?**
This could be Fargate, ECS, or EKS.
**Are you currently working around this issue?**
Currently, I'm just using the integration as currently available, but would prefer to leverage files instead of env variables. I then would have an env variable that serves as a pointer to the file containing the secret value.
**Additional context**
Container images that leverage this approach are plentiful. One example is the `mysql` image. While I wouldn't configure a container this way, I can specify either the `MYSQL_ROOT_PASSWORD` env variable or the `MYSQL_ROOT_PASSWORD_FILE` to serve as a pointer to file containing the actual password. This feature change would help customers leverage several off-the-shelf images that already support file pointing.
Contributor guide
Assessment
This issue has not been assessed yet.