4 ms·

May I ask how you’re managing secrets with this setup? For example, the secret key or database URL. Our current setup deploys an env file which is sourced befo

May I ask how you’re managing secrets with this setup? For example, the secret key or database URL. Our current setup deploys an env file which is sourced before starting the process. I’m less sure how this translates to a production docket deployment.

slow_donkey 8y ago
Docker shouldn't affect your secrets management because secrets shouldn't be baked into your image anyways. I tend to expose them as environment vars and currently use Kubernetes to expose a keyvault url/password so the app can automatically grab all the secrets
- jsmeaton 8y ago
  We manage them with env vars now. But we use salt (encrypted) to deploy a secrets file onto the server which is sourced before the app is started. With something like ECS I didn’t know if you could feed it an env file, and if you could, how you could make it available.
innomatics 8y ago
In ECS you can store them in the task definitions which is easy but might not be secure enough in certain situations. More robust is to read them in from the Parameter Store see https://aws.amazon.com/blogs/compute/managing-secrets-for-amazon-ecs-applications-using-parameter-store-and-iam-roles-for-tasks/ https://aws.amazon.com/blogs/compute/managing-secrets-for-am...
- jsmeaton 8y ago
  Thanks, exactly what I was looking for.
WiseWeasel 8y ago
I've only been using Docker/ECS on side projects, but I generate the production build Docker image with the production .env included, push it to a private repo on Amazon ECR, then pull it in to ECS from there. My understanding is the best practice for Docker/ECS production deployment is to create Docker images containing the full app build, rather than managing the app deployment separately from image deployment. As opposed to development Docker images that rely on docker-compose to mount the host filesystem in the Docker container, the production image Dockerfile includes COPY instructions for the production build files, to be included in the image.

slow_donkey 8y ago

Docker shouldn't affect your secrets management because secrets shouldn't be baked into your image anyways. I tend to expose them as environment vars and currently use Kubernetes to expose a keyvault url/password so the app can automatically grab all the secrets

jsmeaton 8y ago
We manage them with env vars now. But we use salt (encrypted) to deploy a secrets file onto the server which is sourced before the app is started. With something like ECS I didn’t know if you could feed it an env file, and if you could, how you could make it available.

innomatics 8y ago

In ECS you can store them in the task definitions which is easy but might not be secure enough in certain situations. More robust is to read them in from the Parameter Store see https://aws.amazon.com/blogs/compute/managing-secrets-for-amazon-ecs-applications-using-parameter-store-and-iam-roles-for-tasks/ https://aws.amazon.com/blogs/compute/managing-secrets-for-am...

jsmeaton 8y ago
Thanks, exactly what I was looking for.

WiseWeasel 8y ago

I've only been using Docker/ECS on side projects, but I generate the production build Docker image with the production .env included, push it to a private repo on Amazon ECR, then pull it in to ECS from there. My understanding is the best practice for Docker/ECS production deployment is to create Docker images containing the full app build, rather than managing the app deployment separately from image deployment. As opposed to development Docker images that rely on docker-compose to mount the host filesystem in the Docker container, the production image Dockerfile includes COPY instructions for the production build files, to be included in the image.