We run in ECS and use param store for our secrets. You can simply set environment variables in your task definition under secrets.

"containerDefinitions": [
      "secrets": [
        {
          "valueFrom": "/param/path",
          "name": "VARIABLE_NAME"
        }
]

from there I put them in prod.exs as configuration.

I know valueFrom supports secret manager too.

EDIT: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-secrets.html

Oh I’m willing to brainstorm. I’m completely isolated and bored just like you!

I do run as a release.

I actually just created a toy app to investigate possibilities right now.

So I’ve thought about it some more and looked at some docs in the Code module and there’s a warning about evaluating code coming from the network. Dang, seems like loading data from SecretsManager would be a bad idea from a security perspective…

Still - could there be another way??

I want to see if it’s possible. My current solution would be to have the config provider do:

defmodule MyConfigProvider do
  alias ExAws.SecretsManager, as: Secrets

  def init(secret_id) when is_binary(secret_id), do: secret_id

  def load(config, secret_id) do
    %{"SecretValue" => raw_elixir_code} = Secrets.get_secret_value(secret_id) |> ExAws.request!()
    {config_to_merge, _} = Code.eval_string(raw_elixir_code)
    Config.Reader.merge(config, config_to_merge)
  end
end

I have the same idea

defmodule SecretsConfigProvider do
  @behaviour Config.Provider

  def init(path) when is_binary(path), do: path

  def load(config, path) do
    {:ok, _} = Application.ensure_all_started(:jason)

    custom_config =
      path
      |> File.read!()
      |> Jason.decode!(keys: :atoms)
      |> resolve_config()

    Config.Reader.merge(config, custom_config)
  end

  defp resolve_config(config, acc \\ []) do
    Enum.into(config, [], fn
      {key, value} when is_map(value) -> {key, resolve_config(value)}
      {key, value} -> {key, read_secret(value)}
    end)
  end

  @aws [region: "us-west-1"]

  defp read_secret(secret) do
    %{"Parameter" => %{"Value" => value}} =
      secret
      |> ExAws.SSM.get_parameter()
      |> ExAws.request!(@aws)

    value
  end
end

and then load with a json file:

{
  "app": {
    "a": "/insurance/settlement/jobs_url",
    "b": {
      "c": "/notifications/api/url"
    }
  }
}

like

iex(1)> SecretsConfigProvider.load([existing: :config, app: [d: :d]], "/Users/martin/code/tmp/runtime_config/priv/secrets.json")
[
  existing: :config,
  app: [
    d: :d,
    a: "https://REDACTED.execute-api.us-west-1.amazonaws.com/staging",
    b: [c: "https://REDACTED.com"]
  ]
]

I believe this would work and is totally feasible.

…and I may just start using this instead of task definition secrets!

EDIT: Fixed the duplicate issue