This message was deleted.

you can create a AWS secrets manager resource and then reference the arn of that resource in your fargate task definition

"secrets": [
        {
          "name": "DATABASE_PASSWORD",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:awsExampleAccountID:parameter/awsExampleParameter"
        }
      ]

Cheers Mike. That’s helpful 🙂

FYI Pulumi secrets are only secret between where they're persisted, and your code. Once your code puts them somewhere, they're unencrypted. Generally solutions like Mike's are the way to go: the secret is secret in AWS's storage and used by AWS services.

That makes sense and was my understanding (thank you for clarifying though 🙂 )