Question

A development team has been hardcoding database credentials in their application configuration files stored in a private CodeCommit repository. Security wants the credentials centrally managed, encrypted at rest, retrievable at runtime by the application's ECS task, and audited without embedding any long-lived secret in the container image or task definition. Which approach best meets these requirements with the least ongoing credential-handling burden?

Accepted Answer

Store the credentials in AWS Secrets Manager, grant the ECS task role secretsmanager:GetSecretValue and kms:Decrypt, and reference the secret ARN in the task definition's secrets block so ECS injects it at launch.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a String parameter and reference the parameter name as an environment variable in the ECS task definition.

Answer

Encrypt the configuration file with a KMS key, commit the ciphertext to CodeCommit, and have the container decrypt it at startup using the task role.

Answer

Store the credentials as plaintext environment variables in the ECS task definition and restrict access to the task definition using IAM policies.