Getting AWS parameter store secrets inside ecs-cli compose docker container-CodePudding

I have been building a backend for the last few days that I am launching with docker-compose. I use docker secrets to not have to store passwords - for example for the database - in an environment variable.

Since I want to use AWS ECS to run the docker containers online, and unfortunately docker compose is not supported the way I want, I'm trying to rewrite the whole thing into an ECS-compose file. However, I am still stuck on the secrets. I would like to include them like this:

version: 1
task_definition:
   ...
   services:
      my-service:
         ...
         secrets:
          - value_from: DB_USERNAME
            name: DB_USERNAME
          - value_from: DB_PASSWORD
            name: DB_PASSWORD

By doing this, the secrets get saved inside environment variables, aren't they? This is not best practice, or is this case different than other cases?

Can I access these variables without problems inside the container by getting the environment variables?

I hope I have made my question clear enough, if not, please just ask again.

Thanks for the help in advance.

CodePudding user response：

It is not best practise to store sensitive information within environment variables. There is an option within AWS ECS where you can configure the environment variables and get the values of those variables from AWS Secrets Manager. This way, the environment variables are only resolved within the container at run time.

But this still means that the container is going to store the variables as environment variables.

I have faced a similar situation while deploying apps onto EKS. I have setup a central vault server for secrets management within AWS and configured my application to directly call the vault endpoint to get the secrets. I had to complicate my architecture as I had to meet PCI compliance standards. If you are not keen on using vault due to its complexity, you can try knox-app (https://knox-app.com/) which is an online secrets management tool built by lyft engineers.

And to answer your second part of the question - yep. If you set the env variables, you will be able to access them within the container without any problem.