SecretVersionInfo Struct
Specify the secret's version id or version stage.
Example
ts
declare const secret: secretsmanager.Secret;
declare const dbSecret: secretsmanager.Secret;
declare const parameter: ssm.StringParameter;
declare const taskDefinition: ecs.TaskDefinition;
declare const s3Bucket: s3.Bucket;
const newContainer = taskDefinition.addContainer('container', {
image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"),
memoryLimitMiB: 1024,
environment: { // clear text, not for sensitive data
STAGE: 'prod',
},
environmentFiles: [ // list of environment files hosted either on local disk or S3
ecs.EnvironmentFile.fromAsset('./demo-env-file.env'),
ecs.EnvironmentFile.fromBucket(s3Bucket, 'assets/demo-env-file.env'),
],
secrets: { // Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store at container start-up.
SECRET: ecs.Secret.fromSecretsManager(secret),
DB_PASSWORD: ecs.Secret.fromSecretsManager(dbSecret, 'password'), // Reference a specific JSON field, (requires platform version 1.4.0 or later for Fargate tasks)
API_KEY: ecs.Secret.fromSecretsManagerVersion(secret, { versionId: '12345' }, 'apiKey'), // Reference a specific version of the secret by its version id or version stage (requires platform version 1.4.0 or later for Fargate tasks)
PARAMETER: ecs.Secret.fromSsmParameter(parameter),
},
});
newContainer.addEnvironment('QUEUE_NAME', 'MyQueue');
newContainer.addSecret('API_KEY', ecs.Secret.fromSecretsManager(secret));
newContainer.addSecret('DB_PASSWORD', ecs.Secret.fromSecretsManager(secret, 'password'));
python
# secret: secretsmanager.Secret
# db_secret: secretsmanager.Secret
# parameter: ssm.StringParameter
# task_definition: ecs.TaskDefinition
# s3_bucket: s3.Bucket
new_container = task_definition.add_container("container",
image=ecs.ContainerImage.from_registry("amazon/amazon-ecs-sample"),
memory_limit_mi_b=1024,
environment={ # clear text, not for sensitive data
"STAGE": "prod"},
environment_files=[ # list of environment files hosted either on local disk or S3
ecs.EnvironmentFile.from_asset("./demo-env-file.env"),
ecs.EnvironmentFile.from_bucket(s3_bucket, "assets/demo-env-file.env")],
secrets={ # Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store at container start-up.
"SECRET": ecs.Secret.from_secrets_manager(secret),
"DB_PASSWORD": ecs.Secret.from_secrets_manager(db_secret, "password"), # Reference a specific JSON field, (requires platform version 1.4.0 or later for Fargate tasks)
"API_KEY": ecs.Secret.from_secrets_manager_version(secret, ecs.SecretVersionInfo(version_id="12345"), "apiKey"), # Reference a specific version of the secret by its version id or version stage (requires platform version 1.4.0 or later for Fargate tasks)
"PARAMETER": ecs.Secret.from_ssm_parameter(parameter)}
)
new_container.add_environment("QUEUE_NAME", "MyQueue")
new_container.add_secret("API_KEY", ecs.Secret.from_secrets_manager(secret))
new_container.add_secret("DB_PASSWORD", ecs.Secret.from_secrets_manager(secret, "password"))
java
Secret secret;
Secret dbSecret;
StringParameter parameter;
TaskDefinition taskDefinition;
Bucket s3Bucket;
ContainerDefinition newContainer = taskDefinition.addContainer("container", ContainerDefinitionOptions.builder()
.image(ContainerImage.fromRegistry("amazon/amazon-ecs-sample"))
.memoryLimitMiB(1024)
.environment(Map.of( // clear text, not for sensitive data
"STAGE", "prod"))
.environmentFiles(List.of(EnvironmentFile.fromAsset("./demo-env-file.env"), EnvironmentFile.fromBucket(s3Bucket, "assets/demo-env-file.env")))
.secrets(Map.of( // Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store at container start-up.
"SECRET", Secret.fromSecretsManager(secret),
"DB_PASSWORD", Secret.fromSecretsManager(dbSecret, "password"), // Reference a specific JSON field, (requires platform version 1.4.0 or later for Fargate tasks)
"API_KEY", Secret.fromSecretsManagerVersion(secret, SecretVersionInfo.builder().versionId("12345").build(), "apiKey"), // Reference a specific version of the secret by its version id or version stage (requires platform version 1.4.0 or later for Fargate tasks)
"PARAMETER", Secret.fromSsmParameter(parameter)))
.build());
newContainer.addEnvironment("QUEUE_NAME", "MyQueue");
newContainer.addSecret("API_KEY", Secret.fromSecretsManager(secret));
newContainer.addSecret("DB_PASSWORD", Secret.fromSecretsManager(secret, "password"));
csharp
// Install: dotnet add package Amazon.CDK.Lib
Secret secret;
Secret dbSecret;
StringParameter parameter;
TaskDefinition taskDefinition;
Bucket s3Bucket;
var newContainer = taskDefinition.AddContainer("container", new ContainerDefinitionOptions {
Image = ContainerImage.FromRegistry("amazon/amazon-ecs-sample"),
MemoryLimitMiB = 1024,
Environment = new Dictionary<string, string> { // clear text, not for sensitive data
{ "STAGE", "prod" } },
EnvironmentFiles = new [] { EnvironmentFile.FromAsset("./demo-env-file.env"), EnvironmentFile.FromBucket(s3Bucket, "assets/demo-env-file.env") },
Secrets = new Dictionary<string, Secret> { // Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store at container start-up.
{ "SECRET", Secret.FromSecretsManager(secret) },
{ "DB_PASSWORD", Secret.FromSecretsManager(dbSecret, "password") }, // Reference a specific JSON field, (requires platform version 1.4.0 or later for Fargate tasks)
{ "API_KEY", Secret.FromSecretsManagerVersion(secret, new SecretVersionInfo { VersionId = "12345" }, "apiKey") }, // Reference a specific version of the secret by its version id or version stage (requires platform version 1.4.0 or later for Fargate tasks)
{ "PARAMETER", Secret.FromSsmParameter(parameter) } }
});
newContainer.AddEnvironment("QUEUE_NAME", "MyQueue");
newContainer.AddSecret("API_KEY", Secret.FromSecretsManager(secret));
newContainer.AddSecret("DB_PASSWORD", Secret.FromSecretsManager(secret, "password"));
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var secret Secret
var dbSecret Secret
var parameter StringParameter
var taskDefinition TaskDefinition
var s3Bucket Bucket
newContainer := taskDefinition.AddContainer(jsii.String("container"), &ContainerDefinitionOptions{
Image: ecs.ContainerImage_FromRegistry(jsii.String("amazon/amazon-ecs-sample")),
MemoryLimitMiB: jsii.Number(1024),
Environment: map[string]*string{
// clear text, not for sensitive data
"STAGE": jsii.String("prod"),
},
EnvironmentFiles: []EnvironmentFile{
ecs.EnvironmentFile_FromAsset(jsii.String("./demo-env-file.env")),
ecs.EnvironmentFile_FromBucket(s3Bucket, jsii.String("assets/demo-env-file.env")),
},
Secrets: map[string]Secret{
// Retrieved from AWS Secrets Manager or AWS Systems Manager Parameter Store at container start-up.
"SECRET": ecs.Secret_fromSecretsManager(secret),
"DB_PASSWORD": ecs.Secret_fromSecretsManager(dbSecret, jsii.String("password")),
// Reference a specific JSON field, (requires platform version 1.4.0 or later for Fargate tasks)
"API_KEY": ecs.Secret_fromSecretsManagerVersion(secret, &SecretVersionInfo{
"versionId": jsii.String("12345"),
}, jsii.String("apiKey")),
// Reference a specific version of the secret by its version id or version stage (requires platform version 1.4.0 or later for Fargate tasks)
"PARAMETER": ecs.Secret_fromSsmParameter(parameter),
},
})
newContainer.AddEnvironment(jsii.String("QUEUE_NAME"), jsii.String("MyQueue"))
newContainer.AddSecret(jsii.String("API_KEY"), ecs.Secret_FromSecretsManager(secret))
newContainer.AddSecret(jsii.String("DB_PASSWORD"), ecs.Secret_FromSecretsManager(secret, jsii.String("password")))
Properties
versionIdoptionalstringversion_idoptionalstrversionIdoptionalStringVersionIdoptionalstringVersionIdoptional*string#version id of the secret.
Default: use default version id
versionStageoptionalstringversion_stageoptionalstrversionStageoptionalStringVersionStageoptionalstringVersionStageoptional*string#version stage of the secret.
Default: use default version stage