No Plaintext Secrets | Vulnerability Database

Task definition defines sensitive environment variable(s).

You should not make secrets available to a user in plaintext in any scenario. Secrets can instead be pulled from a secure secret storage system by the service requiring them.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Use secrets for the task definition

1
2
3
4
5
6


Resources:
  GoodExample:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Image: amazon/amazon-ecs-sample

Use secrets for the task definition

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


resource "aws_ecs_task_definition" "good_example" {
  container_definitions = <<EOF
 [
   {
     "name": "my_service",
     "environment": [
       { "name": "ENVIRONMENT", "value": "development" }
     ]
   }
 ]
 EOF
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition