Comments (4)
@0xdutra i'm having the same issue. what was the fix?
from terraform-aws-ecs-container-definition.
Same here, @0xdutra did you find a workaround?
from terraform-aws-ecs-container-definition.
@jhole89
unfortunately not yet, I'm using 0.13.5 :/
from terraform-aws-ecs-container-definition.
@0xdutra @mikedizon I managed to use a workaround via secretsmanager (TF v0.14.3, AWS provider v3.24.0, cloudposse/ecs-container-definition v0.46.1).
When previously I had the value stored in the environment
block (causing the panic), you can avoid this by moving the value into secretsmanager and passing this arn to the secrets
block - but you need to give the execution_role_arn
permission to access this, e.g.:
resource "aws_secretsmanager_secret" "foo" {
name = "sensitive_foo"
}
resource "aws_secretsmanager_secret_version" "foo" {
secret_id = aws_secretsmanager_secret.foo.id
secret_string = "I am the sensitive value - I most likely come from some other terraform resource"
}
module "container_definition" {
source = "cloudposse/ecs-container-definition/aws"
version = "0.46.1"
...
...
environment = []
secrets = [
{
name : "MY_ENVAR_KEY",
valueFrom : aws_secretsmanager_secret.foo.arn
},
]
}
data "aws_iam_policy_document" "allow_secrets_access" { // <-- Attach this to your ecs_execution_role
statement {
actions = [
"secretsmanager:GetSecretValue",
]
resources = [
aws_secretsmanager_secret.foo.arn,
]
}
}
An additional note is that if you use kms to securely store secrets, you'd also need to give "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey"
to the kms key used for the secret to the ecs_execution_role, something like:
data "aws_iam_policy_document" "allow_kms" {
statement {
actions = [
"kms:Decrypt",
"kms:DescribeKey",
"kms:GenerateDataKey",
]
resources = [
aws_kms_key.sensitive_foo.arn,
]
}
from terraform-aws-ecs-container-definition.
Related Issues (20)
- Terraform 0.15 error when specifying bool input HOT 4
- ecs_task_definition add support for ephemeral_storage HOT 4
- Capabilities cannot be defined without defining other values HOT 3
- Support initProcessEnabled on ECS Fargate HOT 2
- Add validation to `secrets` and `map_secrets`'s `valueFrom` to ensure it's an arn HOT 1
- Provide command as a string
- Dependency Dashboard
- Error when trying to use EFS volumes in task/container definition HOT 3
- CPU limit is not optional HOT 1
- Log Configuration Options should be options HOT 2
- Feature Request: Support for runtimePlatform HOT 1
- Remove unused dependencies
- Support adding tags HOT 2
- linux_parameters variable value should allow filling only the needed options HOT 1
- The port_mappings variable needs to include the "name" parameter to support Service Connect integration.
- Terraform producing unnecessarily noisy diffs due to omitted lists
- PortMappings variable definition has repeated name argument which fails to initialize HOT 2
- module.this.id not defined HOT 1
- This object does not have an attribute named "target_id".
- Support for `enable_execute_command` flag passed to ECS container-definition HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-aws-ecs-container-definition.