A Config rule that checks if secrets are passed as container environment variables. The rule is NON_COMPLIANT if 1 or more environment variable key matches a key listed in the secretKeys parameter (excluding environmental variables from other locations such as Amazon S3).

This config rule supports the following parameters:

  • secretKeys
    • Required: Yes
    • Type: CSV
    • Description:Comma-separated list of key names to search for in the environment variables of container definitions within Task Definitions. Extra spaces will be removed.

ConfigRule
AWS::Config::ConfigRule


Scope

ComplianceResourceTypes

Source *
CustomPolicyDetails
SourceDetails

CloudFormation Template

Share Template