(aws-ecs): pass a secret to ContainerImage's buildArgs

Currently it is possible to pass only strings to ContainerImage’s buildArgs. Feature request: Add an option to pass a secret to ContainerImage. This parameter can be called buildArgsSecrets or secrets as for QueueProcessingFargateService.

Use Case

I need to create a .ssh key on the machine at build time.

Proposed Solution

const image = ContainerImage.fromAsset('../project-processor', {
  buildArgsSecrets: {
    GIT_SSH_KEY: EcsSecret.fromSecretsManager(secret, 'gitSshKey'),
  }
});

const service = new QueueProcessingFargateService(this, 'QueueProcessingFargateService', {
  cluster,
  queue,
  image,
  secrets: {
    BOT_TOKEN: EcsSecret.fromSecretsManager(secret, 'botToken'),
  }
});

Dockerfile:

ARG GIT_SSH_KEY
RUN echo "${GIT_SSH_KEY}" > /root/.ssh/git_user_key

---

This is a 🚀 Feature Request

[markusl]

We have also a need for this. I originally opened https://github.com/aws/aws-cdk/issues/11623 which was closed as a duplicate of https://github.com/aws/aws-cdk/issues/10999 which is marked as resolved but I think the implementation is still missing.

This is a very essential step for most of our Docker builds where we need to fetch/authenticate to internal repositories.

[AjkayAlan]

We also have a similar need where we need to use have secrets injected via buildArgs (specifically, Artifactory credentials). The suggestions here are viable and would work for us as well. One other thought - Could the buildArgs value be optional? Something like:

readonly buildArgs?: {
    [key: string]: string | undefined;
};

If the value is undefined, CDK could pass the build args to the docker build command without those values, and rely on the local environment (see https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg). This would allow folks to define and/or set those values on their continuous integration as environment variables, but not end up exposing/storing them in the cdk synth output.