# Secret

A secret environment variable.

- Source: [`aws-ecs/lib/container-definition.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-ecs/lib/container-definition.ts#L42)
- Type last changed: v2.13.0 · 19 Feb 2022

## Example

```ts
declare const secret: secretsmanager.Secret;
declare const parameter: ssm.StringParameter;

const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef');
taskDefinition.addContainer('TheContainer', {
  image: ecs.ContainerImage.fromRegistry('example-image'),
  memoryLimitMiB: 256,
  logging: ecs.LogDrivers.firelens({
    options: {
      // ... log driver options here ...
    },
    secretOptions: { // Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store
      apikey: ecs.Secret.fromSecretsManager(secret),
      host: ecs.Secret.fromSsmParameter(parameter),
    },
  }),
});
```

## Initializer

```ts
new Secret()
```

## Properties

- `arn`: string — The ARN of the secret.

- `hasField`: boolean — Whether this secret uses a specific JSON field.

## Methods

- `fromSecretsManager(secret: ISecret, field?: string): Secret // chainable` (static) — Creates a environment variable value from a secret stored in AWS Secrets Manager.

  **Parameters**

  - `secret` — the secret stored in AWS Secrets Manager.
  - `field` — the name of the field with the value that you want to set as the environment variable value.

- `fromSecretsManagerVersion(secret: ISecret, versionInfo: SecretVersionInfo, field?: string): Secret // chainable` (static) — Creates a environment variable value from a secret stored in AWS Secrets Manager.

  **Parameters**

  - `secret` — the secret stored in AWS Secrets Manager.
  - `versionInfo` — the version information to reference the secret.
  - `field` — the name of the field with the value that you want to set as the environment variable value.

- `fromSsmParameter(parameter: IParameter): Secret // chainable` (static) — Creates an environment variable value from a parameter stored in AWS Systems Manager Parameter Store.

- `grantRead(grantee: IGrantable): Grant` — Grants reading the secret to a principal.

  [disable-awslint:no-grants]