aws / amazon-ecs-cli

The Amazon ECS CLI enables users to run their applications on ECS/Fargate using the Docker Compose file format, quickly provision resources, push/pull images in ECR, and monitor running applications on ECS/Fargate.
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_CLI.html
Other
1.78k stars 303 forks source link

`ecs-cli local up` badly handles secrets if the docker-compose container name has dashes #1141

Open remidebette opened 2 years ago

remidebette commented 2 years ago

Summary

Creating a local docker compose file (for example with ecs-cli local create) that contains a container and an AWS secret will fail to populate the environment variables if the container name has dashes.

Description

Taking back the terminology of the initial issue: #797 From creating a docker compose file with command ecs-cli local create

// From task-definition.json
{
  "containerDefinitions": [{
    "name": "example-name-container",
    "secrets": [{
      "name": "environment_variable_name",
      "valueFrom": "arn:aws:secretsmanager:region:aws_account_id:secret:secret_name-AbCdEf"
    }]
  }]
}

We expect a docker-compose file such as:

# To docker-compose.local.yml
services:
  example-name-container:
    environment:
      <environment_variable_name>=${example-name-container_<environment_variable_name}}
    labels:
      ecs-local.secret.environment_variable_name: "arn:aws:secretsmanager:region:aws_account_id:secret:secret_name-AbCdEf"

Expected Behavior

ecs-cli local up should get the value from the AWS Secret and set it in the environment variable <environment_variable_name>

A docker compose file freshly created from ecs-cli local create should work AS-IS

Observed Behavior

The issue is that, with example-name-container having an hyphen -, the container actually running on local will have the env var populated with the value name-container_<environment_variable_name} instead of the content of the secret. (note the value truncated at the first dash)

Instead, if in the docker-compose file one manually modifies the example-name-container container name and all occurences in the environment to example (with no hyphen), then everything works as expected