ecs-no-environment-secrets

Checks if secrets are passed as container environment variables. The rule is NON_COMPLIANT if 1 or more environment variable key matches a key listed in the 'secretKeys' parameter (excluding environmental variables from other locations such as Amazon S3).

Note

This rule only evaluates the latest active revision of an Amazon ECS task definition.

Identifier: ECS_NO_ENVIRONMENT_SECRETS

Resource Types: AWS::ECS::TaskDefinition

Trigger type: Configuration changes

AWS Region: All supported AWS regions except US ISO West, US ISO East, Asia Pacific (Malaysia), US ISOB East, AWS GovCloud (US-East), AWS GovCloud (US-West), Canada West (Calgary) Region

Parameters:

secretKeys

Type: CSV

Comma-separated list of key names to search for in the environment variables of container definitions within Task Definitions. Extra spaces will be removed.

AWS CloudFormation template

To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.