Secrets should not be passed as container environment variables

How to fix it

• Can break clients: Grant the task execution role secretsmanager:GetSecretValue or ssm:GetParameters on each secret or parameter first (and kms:Decrypt for a customer managed key), or the task fails to start.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

environment

Remove the entries the finding lists; replace an AWS key pair with a task role rather than moving it

secrets

One entry per credential: name is the variable the container reads, valueFrom the secret or parameter ARN

Task definition

The new revision, on each service's Update page and in each scheduled task; running tasks keep the old one

With Terraform

resource "aws_ecs_task_definition" "this" {
  family             = "example"
  execution_role_arn = aws_iam_role.task_execution.arn

  container_definitions = jsonencode([{
    name  = "app"
    image = var.container_image
    secrets = [{
      name      = "PASSWORD"
      valueFrom = aws_secretsmanager_secret.db_password.arn
    }]
  }])
}