Check ID: ecs_task_definitions_no_environment_secrets
Provider: AWS
Service: ecs
Severity: CRITICAL
Categories: secrets
Resource type: AwsEcsTaskDefinition

​
What this check verifies

ECS task definitions are analyzed for plaintext secrets placed in container environment variables. It identifies values that resemble credentials (keys, tokens, passwords) within container definitions.

​
Risk

Exposed secrets in env vars undermine confidentiality via logs, task metadata, and introspection. With container or read-only API access, attackers can reuse credentials to read databases, modify records (integrity), pivot to other services, and trigger outages or unauthorized costs (availability).

​
Recommendation

Store secrets in AWS Secrets Manager or SSM Parameter Store and inject them at runtime instead of plaintext env vars. Apply least privilege via task roles, enable regular rotation, avoid logging secret values, and prefer ephemeral credentials for downstream services.

​
Remediation

resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  # Critical: define container secrets instead of plaintext env vars
  container_definitions = jsonencode([
    {
      name    = "app"
      image   = "<image>"
      secrets = [
        { name = "DB_PASSWORD", valueFrom = "<secret_arn_or_parameter_arn>" } # Critical: inject secret at runtime
      ]
    }
  ])
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_no_environment_secrets. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks