chore(aws/ecs): populate environment variables from secret manager secrets

knowledge base/cloud computing/aws/ecs.md

@@ -62,6 +62,9 @@ By default, containers behave like other Linux processes with respect to access
 Unless explicitly protected and guaranteed, all containers running on the same host share CPU, memory, and other
 resources much like normal processes running on that host share those very same resources.
 
+Specify the _execution role_ to allow ECS components to call AWS services when starting tasks.<br/>
+Specify the _task role_ to allow the app running in a task to call AWS services.
+
 <details>
   <summary>Usage</summary>
 
@@ -172,6 +175,57 @@ Whatever the [launch type] or [capacity provider][capacity providers]:
 > [!important]
 > Task definition's parameters differ depending on the launch type.
 
+Specifying the _Execution Role_ in a task definition grants that IAM Role's permissions **to the ECS container
+agent**, allowing it to call AWS when starting tasks.<br/>
+This is required when ECS (and **not** the app in the task's container) needs to make calls to, i.e., read a value from
+Secrets Manager.<br/>
+This IAM Role must allow `ecs.amazonaws.com` to assume it.
+
+<details style='padding: 0 0 1rem 1rem'>
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "AllowECSToAssumeThisVeryRole",
+            "Effect": "Allow",
+            "Principal": {
+                "Service": "ecs.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+```
+
+</details>
+
+Specifying the _Task Role_ in a task definition grants that IAM Role's permissions **to the task's container**.<br/>
+This is required when the app in the task's container (and **not** ECS) needs to make calls to, i.e., recover a file
+from S3.<br/>
+This IAM Role must allow `ecs-tasks.amazonaws.com` to assume it.
+
+<details style='padding: 0 0 1rem 1rem'>
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "AllowECSTasksToAssumeThisVeryRole",
+            "Effect": "Allow",
+            "Principal": {
+                "Service": "ecs-tasks.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+        }
+    ]
+}
+```
+
+</details>
+
 ## Standalone tasks
 
 Refer [Amazon ECS standalone tasks].
@@ -1527,6 +1581,8 @@ Options:
 
 - [Pass Secrets Manager secrets through Amazon ECS environment variables].
 
+Use Secrets Manager in environment variables
+
 When setting environment variables to secrets from Secrets Manager, it is the **execution** role (and **not** the task
 role) that must have the permissions required to access them.
 

knowledge base/cloud computing/aws/secrets manager.md

@@ -50,7 +50,9 @@ When replicating a secret, Secrets Manager creates a copy of the original (A.K.A
 as a _replica_ secret.<br/>
 The replica secret remains linked to the primary secret, and is updated when a new version of the primary is created.
 
-Secrets Manager uses [IAM] to allow only authorized users to access or modify a secret.
+Secrets Manager uses [IAM] to allow only authorized users to access or modify a secret.<br/>
+Permissions for them can be set in IAM Policies that are _identity-based_ (the usual ones, granted to IAM Identities),
+or _resource-based_ (secret-specific).
 
 _Managed_ secrets are created and managed by the AWS service that created them.<br/>
 The managing service might also restrict users from updating secrets, or deleting them without a recovery period.<br/>
@@ -64,6 +66,8 @@ Managed secrets use a naming convention that includes the ID of the service mana
 
 ### Sources
 
+- [Authentication and access control for AWS Secrets Manager]
+
 <!--
   Reference
   ═╬═Time══
@@ -76,5 +80,7 @@ Managed secrets use a naming convention that includes the ID of the service mana
 [Secrets management]: ../../secrets%20management.md
 
 <!-- Upstream -->
+[Authentication and access control for AWS Secrets Manager]: https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html
+
 <!-- Others -->
 [JSON structure of AWS Secrets Manager secrets]: https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html