Support secrets for ECS local containers

[efekarakus]

Summary

As a ECS local user that's specifying sensitive data in my task definition,
I want ECS local to also inject these secrets as environment variables to my local containers,
So that I can validate my container's logic is correct.

Proposed Design

1. Add the ssm or secretsmanager ARN as Docker Labels to each service

While translating the container definition to a Compose file part of local create, we don't want to store the value of a secret as plain text. We'll first add the ARN as a docker label:

// From task-definition.json
{
  "containerDefinitions": [{
    "secrets": [{
      "name": "environment_variable_name",
      "valueFrom": "arn:aws:secretsmanager:region:aws_account_id:secret:secret_name-AbCdEf"
    }]
  }]
}

# To docker-compose.local.yml
my-service:
  environment:
    <environment_variable_name>=${<container-name>_<environment_variable_name}}
  labels:
    ecs-local.secret.enviroment_variable_name: "arn:aws:secretsmanager:region:aws_account_id:secret:secret_name-AbCdEf"

2. Preprend docker-compose up with secret's value

Part of local up now the we can parse the labels and fetch the value of each secret, and then we can run docker-compose up as:

<container-name>_<enviroment_variable_name>=VALUE_OF_SECRET docker-compose -f docker-compose.local.yml up -d

Acceptance Criteria

• Run ecs-cli local up --task-def <REMOTE> with a task definition with multiple secrets
  • Then docker exec <CONTAINERID> env must output the value of the secret