Inject configuration values into an ECS task from AWS Secrets Manager and SSM Parameter Store using the container definition secrets block

Documented steps

1. Store the value out of band first (aws secretsmanager create-secret --name app/db --secret-string file://value.json, or aws ssm put-parameter --name /app/db/token --type SecureString --value file://value.txt). Reading from a file keeps the plaintext out of shell history and CI logs.
2. In containerDefinitions, add a secrets array instead of environment: "secrets": [{"name": "DB_TOKEN", "valueFrom": "<full-secret-arn>"}]. ECS resolves valueFrom at container start and injects the result as an environment variable.
3. To pull a single JSON field out of a multi-field Secrets Manager entry, append the field name to the ARN using the form <secret-arn>:<json-field>:: — the full syntax is secret-arn:json-field:version-stage:version-id, and empty trailing segments default to AWSCURRENT.
4. For SSM Parameter Store use the parameter's full ARN (arn:aws:ssm:<region>:<account>:parameter/app/db/token), or the bare parameter name when the parameter is in the same region as the task.
5. Grant the task EXECUTION role (not the task role) secretsmanager:GetSecretValue on the secret ARN and/or ssm:GetParameters on the parameter ARN.
6. If the entry is encrypted with a customer-managed KMS key rather than the AWS-managed default, also grant kms:Decrypt on that key ARN to the execution role.
7. Register the updated task definition: aws ecs register-task-definition --cli-input-json file://taskdef.json, then deploy: aws ecs update-service --cluster my-cluster --service my-svc --task-definition my-app --force-new-deployment
8. On EC2 launch type with older container agents, set ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE=true so the execution role rather than the instance role is used.
9. Confirm DescribeTaskDefinition output shows only the valueFrom ARN and never the resolved value — that is the security property this pattern buys you over plain environment variables.
10. Official docs: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-secrets-manager.html | https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-ssm-paramstore.html | https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html | https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html