How to use only password of secret from RDS in ECS

❓ General Issue

I wonder what’s the proposed way to use the generated secret from an rds instance/cluster.

const database = new rds.DatabaseCluster(this, 'DatabaseCluster', {
            removalPolicy: RemovalPolicy.DESTROY,
            defaultDatabaseName: scope.getConfig(this, 'wordpressDbName'),
            masterUser: {
                username: 'wordpress',
            },
            instances: 1,
            engine: rds.DatabaseClusterEngine.AURORA,
            instanceProps: {
                instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.SMALL),
                vpc: vpc,
            }
        })

In ECS I would like to get only the password. All other information is known anyway.

WORDPRESS_DB_PASSWORD: ecs.Secret.fromSecretsManager(database.secret?.secretValueFromJson('password')),

but this does not work. Modifications inside the container should not be the solution.

Environment

• CDK CLI Version: 1.19.0
• Module Version: 1.19.0

[ogrodnek]

Would be great to get the json key support for ECS secrets!

[jogold]

Sadly this is currently not possible without code modifications inside the conainter, see https://github.com/aws/containers-roadmap/issues/385