Скачать или смотреть Resolving the AWS SSM valueFrom Issue in Terraform for ECS Tasks

A comprehensive guide on fixing the AWS SSM `valueFrom` not working in Terraform when defining ECS task definitions.
---
This video is based on the question https://stackoverflow.com/q/69247126/ asked by the user 'mrc' ( https://stackoverflow.com/u/5556466/ ) and on the answer https://stackoverflow.com/a/69247328/ provided by the user 'Mark B' ( https://stackoverflow.com/u/13070/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: AWS SSM as a valueFrom for task in Terraform not working

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Resolving the AWS SSM valueFrom Issue in Terraform for ECS Tasks

When working with AWS Elastic Container Service (ECS) and Terraform, developers often need to retrieve sensitive information such as environment variables from AWS Systems Manager (SSM). However, some users face issues where valueFrom is not being recognized, causing the task definitions to not display the expected environment variables. This guide will explore a common issue encountered with the AWS SSM values inside ECS task definitions defined in Terraform and provide a step-by-step solution.

The Problem

You have successfully defined an ECS task using the aws_ecs_task_definition module in Terraform, where some environment variables are set directly, while others should be fetched from AWS SSM. Here’s what you might typically do:

Direct Environment Variable Definition

[[See Video to Reveal this Text or Code Snippet]]

This configuration works perfectly. However, attempting to set an environment variable using valueFrom from SSM can lead to issues like this:

Attempting to Use valueFrom

[[See Video to Reveal this Text or Code Snippet]]

This does not yield the expected results. The environment variable does not appear in the ECS task definition UI, nor in the JSON definition.

The SSM Value Retrieval Complication

When you manually create the SSM variable in AWS UI, it appears properly in the task definition under the secrets section. You might have tried defining it in Terraform like this:

[[See Video to Reveal this Text or Code Snippet]]

However, the value still doesn’t show up correctly. If you inspect the task definition JSON output in Terraform, you’ll find secrets set to null, causing the confusion.

The Solution

The confusion in the setup arises due to defining the secrets section twice, once containing valid data, and again being overridden with null. Here's how to resolve it:

Step 1: Identify Duplicate Definitions

Inspect the relevant section of your ECS task definition. You might see this:

[[See Video to Reveal this Text or Code Snippet]]

Notice that secrets is defined twice. The second definition (secrets : null) effectively nullifies your inputs.

Step 2: Remove the Override

Remove the null definition to keep your valid secrets configuration:

[[See Video to Reveal this Text or Code Snippet]]

Ensure that no line in your Terraform file sets secrets to null.

Step 3: Validate and Apply

Now, save your changes. Run the following command to apply the changes:

[[See Video to Reveal this Text or Code Snippet]]

This should now properly show the environment variable populated from AWS SSM under the secrets section in the ECS Task Definition JSON output.

Conclusion

Working with environment variables in AWS ECS through Terraform using SSM can seem complicated at first. However, by ensuring no conflicting definitions exist for the secrets attribute, you can streamline the process.

Removing any redundant null definitions should solve the issues you were facing. With this guide, you should now be able to successfully retrieve values stored in AWS SSM and use them in your ECS task definitions efficiently.

If you encounter further issues, don’t hesitate to refer to the AWS and Terraform documentation or reach out to the community for support.