SecretOptions for FireLens

It is currently possible to define secrets for FireLens logging configurations. [1]
This is not implemented in the FireLensLogDriver from @aws-cdk/aws-ecs.

[1] https://github.com/aws-samples/amazon-ecs-firelens-examples/blob/master/examples/fluent-bit/datadog/task-definition.json

Use Case

It is important to define secrets via secretOptions otherwise the API keys such as the DataDog API key are displayed as plain text in some logs.

Proposed Solution

I implemented a workaround as a custom class (which extends the current aws-cdk implementation), but I guess that the property should simply be added to the FireLensLogDriver.

import { FireLensLogDriver, FireLensLogDriverProps, LogDriverConfig, ContainerDefinition } from "@aws-cdk/aws-ecs";
import { Construct } from "@aws-cdk/core";
import { IStringParameter } from "@aws-cdk/aws-ssm";

interface FireLensSecret {
    valueFrom: IStringParameter;
    name: string;
}

interface FireLensSecretAsString {
    valueFrom: string;
    name: string;
}

/**
 * Specifies the firelens log driver configuration options.
 */
export interface FireLensLogDriverWithSecretsProps extends FireLensLogDriverProps {
    /**
     * The configuration options to send to the log driver.
     * @default - the log driver options
     */
    readonly secretOptions?: FireLensSecret[];
}

export interface FireLensWithSecretLogDriverConfig extends LogDriverConfig {
    readonly secretOptions: FireLensSecretAsString[];
}

export class FireLensLogDriverWithSecrets extends FireLensLogDriver {
    private readonly secretOptions: FireLensSecret[];

    /**
     * Constructs a new instance of the FireLensLogDriver class.
     * @param props the awsfirelens log driver configuration options.
     */
    constructor(props: FireLensLogDriverWithSecretsProps) {
        super(props);

        this.secretOptions = props.secretOptions || [];
    }

    /**
     * Called when the log driver is configured on a container
     */
    public bind(_scope: Construct, _containerDefinition: ContainerDefinition): FireLensWithSecretLogDriverConfig {
        const config = super.bind(_scope, _containerDefinition);

        return {
            secretOptions: this.secretOptions.map((mapping) => {
                return {
                    name: mapping.name,
                    valueFrom: mapping.valueFrom.parameterArn,
                };
            }),
            ...config,
        };
    }
}

My sample implementation above does not take into account Secrets Manager credentials. It is for SSM parameters only.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[epvanhouten]

I am needing this functionality as well.

[tobli]

See also https://github.com/aws/aws-cdk/issues/7264. I was looking into a PR for that, but support for secret log options should be applicable to all log drivers.