When is the ECS secret is resolved?

ECS resolves secrets from AWS Secrets Manager or Systems Manager Parameter Store at task start time. This means that secret values are fixed for the duration of the task's runtime and are not updated dynamically if the secrets change afterward. To apply updated secrets, tasks need to be restarted or redeployed. Proper handling of secrets involves understanding these mechanics and implementing strategies for managing updates effective

Practical Scenario with Sidecar and App Tasks .Suppose you have a sidecar container responsible for updating a secret in Secrets Manager. This sidecar task may run before or alongside the app task. The app task depends on the secret updated by the sidecar. However, if the app task is running and the sidecar updates the secret afterward, the app task will not see the updated value until it is restarted. In the container environment The app container will continue to use the value of the secret that was resolved when it initially started. The environment variable containing the secret does not dynamically update if the secret value changes while the task is running.

To resolve this issue and ensure the app uses the latest secret value, you'll need to restart the app container. This can be achieved by:

1. Updating the ECS service: Force a new deployment of the service, which will cause all tasks (including the app container) to be restarted.
2. Using a secrets management client library: The app can periodically retrieve the latest secret value from Secrets Manager using a client library. This approach provides more flexibility but requires additional code and management.

• Secrets are resolved at container start time, not task start time.
• Updating a secret in Secrets Manager does not automatically update its value in running containers.
• To use the latest secret value, you must restart the container or use a secrets management client library.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html