# Ensure no secrets are found in ECS task definitions variables

- Source: https://support.icompaas.com/support/solutions/articles/62000127120-ensure-no-secrets-are-found-in-ecs-task-definitions-variables
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

**Elastic Container Service (ECS)** is a fully managed container orchestration service. It makes it easy to run and stop managing containers in a cluster. It enables you to inject sensitive data into your containers by storing your sensitive data in AWS Secrets Manager secrets and then referencing them in your container definition.

As a security best practice, pass sensitive information to containers as environment variables. You can securely inject data into containers by referencing values stored in the AWS Systems Manager Parameter Store or AWS Secrets Manager in the container definition of an Amazon ECS task definition. Then, you can expose your sensitive information as environment variables or in the log configuration of a container.

  

## **Rationale:**

ECS task definition variables are metadata definitions, which usually contain small configurations that define the ECS cluster execution parameters. These variables can be accessed by any entity with the most basic read-metadata-only permissions and can't be encrypted. 

  

## **Impact:**

It is recommended you remove secrets from unencrypted places, especially if they can be easily accessed, to reduce the risk of exposing data to third parties. 

  

### **Default Value:**

Amazon ECS **enables** you to inject sensitive data into your containers by storing your sensitive data in AWS Secrets Manager secrets and then referencing them in your container definition. 

  

### **Pre-Requisite:**

-   Have a secret stored in Secret Manager.
-   You attach the required policy to the IAM Role - ecsTaskExecutionRole.
-   ECR cluster and the Task should be running.

  

## **Remediation:**

  

## **Test Plan:**

  

1.  Find the public IP or DNS address for your container instance.
    
    1.  Open the Amazon ECS console at [https://console.aws.amazon.com/ecs/](https://console.aws.amazon.com/ecs/ "https://console.aws.amazon.com/ecs/").
        
    2.  Select the cluster or other clusters that hosts your container instance.
        
    3.  On the **Cluster** page, choose **ECS Instances**.
        
    4.  On the **Container Instance** column, select the container instance to connect to.
        
    5.  On the **Container Instance** page, record the **Public IP** or **Public DNS** for your instance.
        
2.  If you are using a macOS or Linux computer, connect to your instance with the following command, substituting the path to your private key and the public address for your instance:
    

$ ssh -i /path/to/my-key-pair.pem ec2-user@ec2-198-51-100-1.compute-1.amazonaws.com

For more information about using a Windows computer, see [Connecting to Your Linux Instance from Windows Using PuTTY](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.html "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.html") in the _Amazon EC2 User Guide for Linux Instances_.

  3. List the containers running on the instance. Note the container ID for container.

docker ps

 4. Connect to the container using the container ID from the output of the previous step. 

docker exec -it container\_ID /bin/bash

  

 5. Use the `echo` command to print the value of the environment variable.

echo $username\_value

If the tutorial was successful, you should see the following output: 

password\_value

[Draft](https://support.icompaas.com/support/solutions/articles/62000127120-ensure-no-secrets-are-found-in-ecs-task-definitions-variables/preview)

  

### **Implementation Plan:**

1.  Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
    
2.  In the navigation pane, choose **Roles**. 
    
3.  Search the list of roles for ecsTaskExecutionRole  and select it.
    
4.  Choose **Permissions**, then choose the **X** next to the container. Choose to **Remove** to confirm the removal of the inline policy.
    
5.  Open the Secrets Manager console at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").
    
6.  Select the secret you created and choose **Actions**, **Delete secret**.
    

The following command removes the policy from the role.

aws iam delete-role-policy --role-name <role-name> --policy-name <policy-name>

The following example deletes a secret immediately without a recovery window. You can't recover this secret. 

  

aws secretsmanager delete-secret \\  
    --secret-id <secret-id> \\  
    --force-delete-without-recovery

### **Back out Plan:**

**To create a basic secret**

Use Secrets Manager to create a secret for your sensitive data.

1.  Open the Secrets Manager console at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").
    
2.  Choose **Store a new secret**.
    
3.  At the **Secret type**, choose “**Other type of secrets”**.
    

  

![](https://support.icompaas.com/assets/kb/d8f9d94709b93948.png)

  

    4. At the **Key/Value pairs**, choose the **Plaintext** tab and replace the existing text with the following text. The text value you specify here will be the environment variable value in your container at the end of the tutorial.

![](https://support.icompaas.com/assets/kb/d6c21b2865b7e3ee.png)  

password\_value

1.  Choose **Next**.
    
2.  For the **Secret name**, type `username_value` and choose **Next**. The secret name value you specify here will be the environment variable name in your container at the end of the tutorial.
    
3.  For **Configure automatic rotation**, leave **Disable automatic rotation** selected and choose **Next**.
    
4.  Review these settings, and then choose **Store** to save everything you entered as a new secret in Secrets Manager.
    
5.  Select the secret you just created and save the **Secret ARN** to reference in your task execution IAM policy and task definition in later steps.
    

  

  

**To update your task execution IAM role**

Use the IAM console to update your task execution role with the required permissions.

1.  Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
    
2.  In the navigation pane, choose **Roles**.
    
3.  Search the list of roles for `ecsTaskExecutionRole` and select it.
    
4.  Choose **Review policy**. For **Name** specify `ECSSecretsTutorial`, then choose **Create policy**
    

  

**To create a task definition that specifies a secret**

Use the IAM console to update your task execution role with the required permissions.

1.  Open the Amazon ECS console at [https://console.aws.amazon.com/ecs/](https://console.aws.amazon.com/ecs/ "https://console.aws.amazon.com/ecs/").
    
2.  In the navigation pane, choose **Task Definitions**, **Create new Task Definition**.
    
      
    
      
    
      
    
      
    
      
    
      
    

  

![](https://support.icompaas.com/assets/kb/7b517d8828806ae8.png)

    3. On the **Select launch type compatibility**  page, choose **EC2** and choose **Next step** 

    4. Choose **Configure via JSON** and enter the following task definition JSON text, ensuring that you specify the full ARN of the Secrets Manager secret you created in step 1 and the task execution IAM role you updated in step 2. Choose **Save**.

  

{  
    "executionRoleArn": "arn:aws:iam::aws\_account\_id:role/ecsTaskExecutionRole",  
    "containerDefinitions": \[  
        {  
            "entryPoint": \[  
                "sh",  
                "-c"  
            \],  
            "portMappings": \[  
                {  
                    "hostPort": 80,  
                    "protocol": "tcp",  
                    "containerPort": 80  
                }  
            \],  
            "command": \[  
                "/bin/sh -c \\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' >  /usr/local/apache2/htdocs/index.html && httpd-foreground\\""  
            \],  
            "cpu": 10,  
            "secrets": \[  
                {  
                    "valueFrom": "arn:aws:secretsmanager:region:aws\_account\_id:secret:username\_value-u9bH6K",  
                    "name": "username\_value"  
                }  
            \],  
            "memory": 300,  
            "image": "httpd:2.4",  
            "essential": true,  
            "name": "ecs-secrets-container"  
        }  
    \],  
    "family": "ecs-secrets-tutorial"  
}

    5. Review the settings and then choose to **Create**.

**To create a cluster**

Use the Amazon ECS console to create a cluster and register one container instance to it.

1.  Open the Amazon ECS console at [https://console.aws.amazon.com/ecs/](https://console.aws.amazon.com/ecs/ "https://console.aws.amazon.com/ecs/").
    
2.  From the navigation bar, select the Region that contains both the Secrets Manager secret and the Amazon ECS task definition you created.
    
3.  In the navigation pane, choose **Clusters**.
    
4.  On the **Clusters** page, choose **Create Cluster**.
    
5.  For the **EC2 instance type**, choose **t2.micro**.
    
6.  For the **Key pair**, choose a key pair to add to the container instance.
    
7.  Leave all other fields at their default values and choose to **Create**.
    

### **References:**

1.  [![](https://support.icompaas.com/assets/kb/78c6812d6b2ed3f7.png)What is Amazon Elastic Container Service? - Amazon Elastic Container Service](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) 
    
2.  [![](https://support.icompaas.com/assets/kb/e02c7081dfd9f777.png)Passing sensitive data to a container - Amazon Elastic Container Service](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-secrets.html) 
    
3.  [![](https://support.icompaas.com/assets/kb/a7f030973cfd7f68.png)Tutorial: Specifying Sensitive Data Using Secrets Manager Secrets - Amazon Elastic Container Service](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-tutorial.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.