Work
AWS ECS Secret Rotation
A Terraform module to redeploy an AWS ECS service whenever particular AWS secrets rotate.
Brief
A common problem (see here and here) that developers (and possibly yourself) have encountered is needing to redeploy/restart an AWS ECS service whenever an AWS secret rotates. This is because if you’re using AWS secrets as environment variables for your ECS service, those environment variable values are fixed at the point of deployment.
This is problematic for rotating secrets. In my case with Epilogue, my AWS RDS database credential secret rotated regularly, so my backend was unable to successfully authorise with my database because it was using old credentials.
AWS have a guide for restarting AWS services using their CloudFormation template, but I didn’t find any existing Terraform modules to help with this. So, I made one!
How to use it
See the Terraform module page for instructions on how to use it and the argument reference.
You can also find the project on GitHub.
Alternatives
I’ve documented alternative and a simpler approach in the GitHub README. If you can, I’d recommend having your service re-fetch the AWS secret value it needs at runtime when required.
At the time, I thought my Terraform module approach would be simpler, but in retrospect, it wasn’t. I also would go for that approach.