const parameter = new aws.ssm.Parameter("SECRET", {
    type: "SecureString",
    value: config.requireSecret("myPulumiSecret"),
});

const service = new awsx.ecs.FargateService("service", {
    cluster,
    desiredCount: 2,
    taskDefinitionArgs: {
        container: {
            secrets: [{
                name: parameter.name,
                valueFrom: parameter.arn, // FAILS, Type 'Output<string>' is not assignable to type 'string'.
            }],
        },
    }
});

secrets: pulumi.all([parameter.name, parameter.arn])
                .apply(([name, valueFrom]) => [{ name, valueFrom }])