Secrets from Secrets Manager into ECS — Never Through State

1. 1

   Teach ShopLite to talk to Postgres

   Add the pg driver (npm install pg in app/). The pool reads connection details from environment variables and verifies the server certificate against Amazon's RDS CA bundle. With rds.force_ssl = 1, unencrypted connections are refused anyway, and verifying the CA also protects against impersonation. A new /healthz/db endpoint proves the whole chain. The handler becomes async.

   Add the imports and pool at the top; make the handler async and add the /healthz/db route.

   import fs from "node:fs";
   import pg from "pg";
   
   const pool = process.env.DB_HOST
     ? new pg.Pool({
         host: process.env.DB_HOST,
         database: process.env.DB_NAME,
         user: process.env.DB_USER,
         password: process.env.DB_PASSWORD,
         port: 5432,
         max: 5,
         ssl: { ca: fs.readFileSync("/app/rds-ca.pem", "utf8") },
       })
     : null;
   
   const server = http.createServer(async (req, res) => {
     if (req.url === "/healthz") return json(res, 200, { status: "ok" });
     if (req.url === "/healthz/db") {
       if (!pool) return json(res, 503, { db: "not configured" });
       try {
         const { rows } = await pool.query("select version()");
         return json(res, 200, { db: "ok", version: rows[0].version.split(",")[0] });
       } catch (err) {
         return json(res, 503, { db: "error", message: err.message });
       }
     }
     // ... existing /products and fallback routes

2. 2

   Bake the CA bundle into the image

   ADD <url> downloads the RDS global CA bundle at build time. Files added this way are root-owned with restrictive permissions, so chmod 644 lets the unprivileged node user read it. That's an easy bug to miss until the container crashes with EACCES. npm ci --omit=dev installs exactly the lockfile's production dependencies.

   FROM node:22-alpine
   WORKDIR /app
   ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /app/rds-ca.pem
   RUN chmod 644 /app/rds-ca.pem
   COPY package.json package-lock.json ./
   RUN npm ci --omit=dev
   COPY server.js ./
   USER node
   EXPOSE 8080
   CMD ["node", "server.js"]

   terminalcopy cmd

   $ cd ../app && npm install pg && npm pkg set version=1.2.0 && cd ../infra

   docker buildx build --platform linux/arm64 -t "$REPO:1.2.0" --push ../app

   ── expected output ──

   => pushing 123456789012.dkr.ecr.ap-south-1.amazonaws.com/shoplite/api:1.2.0

3. 3

   Let the execution role read exactly one secret

   The permission goes on the EXECUTION role, because ECS fetches the secret before your code starts. The resource is this one secret's ARN, not *. The RDS-managed secret is encrypted with the AWS-managed aws/secretsmanager key, so no extra KMS permission is needed.

   locals {
     db_secret_arn = aws_db_instance.main.master_user_secret[0].secret_arn
   }
   
   data "aws_iam_policy_document" "ecs_execution_secrets" {
     statement {
       actions   = ["secretsmanager:GetSecretValue"]
       resources = [local.db_secret_arn]
     }
   }
   
   resource "aws_iam_role_policy" "ecs_execution_secrets" {
     name   = "read-db-secret"
     role   = aws_iam_role.ecs_execution.id
     policy = data.aws_iam_policy_document.ecs_execution_secrets.json
   }

4. 4

   Pass connection details: config as env, credentials as secrets

   Host and database name aren't secret, so they go in environment. Username and password come from the secret's JSON keys through secrets.

   Inside container_definitions: extend environment, add a secrets list.

       environment = [
         { name = "PORT", value = tostring(var.app_port) },
         { name = "APP_VERSION", value = var.image_tag },
         { name = "DB_HOST", value = aws_db_instance.main.address },
         { name = "DB_NAME", value = aws_db_instance.main.db_name },
       ]
   
       secrets = [
         { name = "DB_USER", valueFrom = "${local.db_secret_arn}:username::" },
         { name = "DB_PASSWORD", valueFrom = "${local.db_secret_arn}:password::" },
       ]

5. 5

   Deploy 1.2.0

   Set image_tag = "1.2.0" in terraform.tfvars and apply. The plan shows the new policy, a new task definition revision, and the service update.

   terminalcopy cmd

   $ terraform apply

   curl -s "$(terraform output -raw api_url)/healthz/db"; echo

   ── expected output ──

   Plan: 2 to add, 1 to change, 1 to destroy.

   ...

   Apply complete! Resources: 2 added, 1 changed, 1 destroyed.

    

   {"db":"ok","version":"PostgreSQL 16.6 on aarch64-unknown-linux-gnu"}

6. 6

   Prove the password is nowhere in Terraform

   Search the entire remote state and the registered task definition for the actual password. Both searches find zero matches. The state contains the secret's ARN, and that's all.

   terminalcopy cmd

   $ PW=$(aws secretsmanager get-secret-value --secret-id "$(terraform output -raw db_master_secret_arn)" --query SecretString --output text | jq -r .password)

   terraform state pull | grep -c -- "$PW"

   aws ecs describe-task-definition --task-definition shoplite-dev-api | grep -c -- "$PW"

   unset PW

   ── expected output ──

   0

   0

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.