const jwtSecretParam = new aws.ssm.Parameter('JWT_SECRET', {
  type: 'SecureString',
  value: cfg.requireSecret('JWT_SECRET'),
});

const service = new awsx.ecs.FargateService('api', {
  desiredCount: 2,
  taskDefinitionArgs: {
    cpu: '256',
    memory: '512',
    container: {
      secrets: [
        {
          name: 'JWT_SECRET',
          valueFrom: jwtSecretParam.arn,
        },
      ],
    },
  },
});