How can you pass private environment variables to FARGATE tasks specified from a Docker Compose config
This is a well-written and up-to-date article which summarises the problem I've hit and confirms there isn't really a perfect solution at the moment in Fargate.

https://hackernoon.com/secrets-management-within-aws-ecs-1b6975819ccd - Connor Beardsmore

The alternatives listed are:


Bake into Docker - not an option with an open source repo
ECS Environment Variables - as I mentioned less secure
Docker Fetches from SSM Parameter Store - secure but "architecturally dirty"
Wait for Fargate SSM to be able to inject sensitive data!


Re. option 2. the problem is the environment variables are visible in the AWS console. But I wonder: if an attacker has access to your AWS console, you're pretty screwed already? So isn't this in fact an practically acceptable solution?