I believe it's possible to write the ECS task definition as a JSON file, include environment variables, commit it to a repo, then use AWS CodeDeploy/CodePipelin

I believe it's possible to write the ECS task definition as a JSON file, include environment variables, commit it to a repo, then use AWS CodeDeploy/CodePipeline to update ECS with a new task revision whenever the repo changes... ...which kinda proves your point. This stuff is not well documented and it's ever more complexity.