aws / aws/containers-roadmap

[Fargate] [Secrets]: Dynamically pushing secrets to Containers

Open
#495 8 comments 17 reactions 0 assignees View on GitHub
ECS Fargate Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
Would like to get secrets dynamically updated in containers, when they are rotated in respective Secret Manager or SSM Parameter Store.

**Which service(s) is this request for?**
This could be Fargate, ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently when secrets are rotated in secret Manager or SSM Parameter store, the container will not receive the updated value automatically.
Either task refresh or force service update is required as secrets are pulled when task starts.
Would like to get secrets dynamically updated in containers, when they are rotated in respective Secret Manager or SSM Parameter Store.

**Are you currently working around this issue?**

**Additional context**
When running tasks at production scale of 1k or more tasks, its becomes unreasonable to refresh or update the task for fetching new credentials.

**Attachments**

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html

Sensitive data is injected into your container when the container is initially started. If the secret or Parameter Store parameter is subsequently updated or rotated, the container will not receive the updated value automatically. You must either launch a new task or if your task is part of a service you can update the service and use the Force new deployment option to force the service to launch a fresh task.

Contributor guide

Open the contributing guide

Research direction

Start with the linked ECS sensitive-data documentation and review how Fargate and ECS inject values from Secrets Manager or SSM Parameter Store at task startup. Define the approach for propagating rotations to running containers without refreshing tasks; done means updated secret values reach production-scale tasks without a forced new deployment.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.