[Fargate] [Secrets]: Dynamically pushing secrets to Containers
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
Would like to get secrets dynamically updated in containers, when they are rotated in respective Secret Manager or SSM Parameter Store.
**Which service(s) is this request for?**
This could be Fargate, ECS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently when secrets are rotated in secret Manager or SSM Parameter store, the container will not receive the updated value automatically.
Either task refresh or force service update is required as secrets are pulled when task starts.
Would like to get secrets dynamically updated in containers, when they are rotated in respective Secret Manager or SSM Parameter Store.
**Are you currently working around this issue?**
**Additional context**
When running tasks at production scale of 1k or more tasks, its becomes unreasonable to refresh or update the task for fetching new credentials.
**Attachments**
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html
Sensitive data is injected into your container when the container is initially started. If the secret or Parameter Store parameter is subsequently updated or rotated, the container will not receive the updated value automatically. You must either launch a new task or if your task is part of a service you can update the service and use the Force new deployment option to force the service to launch a fresh task.
Contributor guide
Research direction
Start with the linked ECS sensitive-data documentation and review how Fargate and ECS inject values from Secrets Manager or SSM Parameter Store at task startup. Define the approach for propagating rotations to running containers without refreshing tasks; done means updated secret values reach production-scale tasks without a forced new deployment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100