Is there a way to read the parameter store secure variables inside the ECS JSON environment sections based on FARGATE

Question

I am setting up ECS Services to launch my application which speaks to the RDS Database server. I need to pass the Database access properties such as username, password, dbname etc to the application codes running in the FARGATE instances. So to pass them i have created these parameters in the parameter store, but i need to find a way to get them from the parameter store and pass it to the ECS task definitons env variable properties?

In the ECS Task definitions, i have tried to modify the JSON file environment property with the parameters such as "name: and "valueFrom", but seems that the "valueFrom:" is not being accepted in the JSON file, it pops out an error saying "Cannot read property 'replace' of undefined"

        "environment": [
            {
                "name": "POSTGRES_DB",
                "valueFrom": "PROD_POSTGRES_DB"
            }
        ],

I expect that the POSTGRES_DB parameter reads the values from the PROD_POSTGRES_DB defined in parameter store of AWS

Answer 1

When you use SSM Parameter Store in ECS Task Definition for the valueFrom environment variables, it creates separate secrets section under containerDefinitions. So, it will look like below.

"containerDefinitions": [
    {
        "secrets": [
            {
                "name": "POSTGRES_DB",
                "valueFrom": "PROD_POSTGRES_DB"
            }
        ],
        "environment": [
            {
                "valueFrom": "myKey",
                "name": "myValue"
            }
        ],
    }
]

For the normal value environment variables, it will be usual environment json array.

Note -

1. When you use SSM Parameter Store, you have to make sure Task Execution Role has necessary SSM Permissions attached to role. Reference - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html
2. Also, try to provide full SSM Parameter ARN if your ECS region is different from SSM region.