aws / aws/containers-roadmap

[ECS] [parameter get all keys by path]: secrets from parameter store just provide a path

Open
#535 8 comments 24 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

In ECS and the task definition I use secrets stored in parameter store like:

```
"secrets":[
{
"valueFrom":"arn:aws:ssm:us-west-1:XXXXXXXXXXX:parameter/WEB_APP/DB_PASSWORD",
"name":"DB_PASSWORD"
},
{
"valueFrom": "arn:aws:ssm:us-west-1:XXXXXXXXXXX:parameter/WEB_APP/DB_USERNAME",
"name": "DB_USERNAME"
},
{
"valueFrom": "arn:aws:ssm:us-west-1:XXXXXXXXXXX:parameter/WEB_APP/DB_HOST",
"name": "DB_HOST"
},
...
]
````

We have lots of secrets, so defining all them in the task definition JSON becomes tedious and very error prone. Instead, I should just be able to define a **path** and ECS should pull down all keys in that path from parameter store and use them.

Example of how that could look:

```
"secrets":[
{
"valueFrom":"arn:aws:ssm:us-west-1:XXXXXXXXXXX:parameter/WEB_APP/*"
}
]
````

Contributor guide

Open the contributing guide

Research direction

Start by reviewing ECS task-definition secret handling and AWS Systems Manager Parameter Store path semantics. The requested outcome is for a task definition to reference a parameter path and have ECS retrieve all matching secrets without listing each key individually; the payload names no repository files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.