Amazon-ecs-agent: Service:AmazonECS, Code:ClientException, Message:Actual length: '34432'. Max allowed length is '32768' bytes., Class:com.amazonaws.services.ecs.model.ClientException

[devotox]

This error is thrown when the Environment variables passed in to elastic beanstalk seems to be more than what ECS can handle.

This limit seems arbitrary as i need to be able to add Environment variables or how else can we pass in secret keys

[richardpen]

@devotox Currently ECS has a hard 32 kb limit on the size of task definition which is why this error occurred. Here is the document that record the limits of ECS service: ECS Service limits.
In general, we do not recommend passing in secrets as environments variables to your containers, as they do not provide a high level of security on the instance. However you can use the S3 and AWS KMS to manage the secrets for EC2 Container Service, which is more secure than passing directly in environment variable. See How to Manage Secrets for Amazon EC2 Container Service–Based Applications by Using Amazon S3 and Docker for the instructions.

Thanks.

[devotox]

thank you for the links and the explanation

[banchee]

Will there ever be a time this will be increased to 64k? We use the secrets parameter on the container definition for fargate, in conjunction with ssm params and are hitting the 32k limit.

Moving it over to use something like S3 and KMS is not feasible for us now and will require deviating from standard functionality supplied by ECS fargate, and most properly have to redo our whole secrets approach, which is not something we feel like repeating again.