Hello, I’m looking for a Pulumi example of how to pass a secret (at the moment it’s a pulumi secret) to a ECS Fargate Task container secrets, so I can inject passwords in a secure way. Would you be able to point me to some relevant documentation / resources?

you can create a AWS secrets manager resource and then reference the arn of that resource in your fargate task definition

"secrets": [
        {
          "name": "DATABASE_PASSWORD",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:awsExampleAccountID:parameter/awsExampleParameter"
        }
      ]

Cheers Mike. That’s helpful 🙂

FYI Pulumi secrets are only secret between where they're persisted, and your code. Once your code puts them somewhere, they're unencrypted. Generally solutions like Mike's are the way to go: the secret is secret in AWS's storage and used by AWS services.

That makes sense and was my understanding (thank you for clarifying though 🙂 )