Compose variable from other variables in manifest.yml

[waveozhangli]

Requirement:
I have DB_USERNAME and DB_PASSWORD variables configured in manifest.yml file. Which refer to the Parameter Store keys.
Can I add 3rd variable DB_URL based on the 2 variables above? something like this:
jdbc:mysql://mydb.example.com/mydb?user=${DB_USERNAME}&password=${DB_PASSWORD}

I have tried ${DB_PASSWORD}, got DB_PASSWORD not defined error
and I have tried ${/path/to/my/parameter/store/key}, it is not substituted

I have checked document: https://aws.github.io/copilot-cli/docs/developing/manifest-env-var/
Did not find any info, neither

There's similar question mentioned here: #2483 (comment)
But the problem was not solved, also it is closed

Thanks in advance for any feedback!

[bvtujo]

This is an interesting feature request. The issue here is that because you're dealing with sensitive secrets, the secrets are pulled on container startup and injected as environment variables when the ECS backend executes essentially a "docker run". This keeps secret values secret and doesn't run the risk of exposing them as plaintext. That's why Copilot can't do this, and why it's an ECS feature request--the task definition would have to support composing variables for this to be secure in its implementation.

As a workaround, can you define a custom entrypoint to your docker container which defines this variable from the existing secrets? Or create it in your application code?

[waveozhangli]

Thank you very much for your reply! @bvtujo
For now, as a workaround, I just stored the whole db connection string into Parameter Store, DB_URL is referring to it. Similar as DB_USERNAME and DB_PASSWORD variables, it is a little bit redundant, but at least it works.

[ShanikaEdiriweera]

I have a similar issue where I need to substitute the environment variable with value from ssm secret. #5516 (comment)

Hope this would be prioritised!

[iamhopaul123]

Resolved by #5516. Feel free to reopen!

[KollaAdithya]

Here is a use case where I want to resolve TEST1 url as https://example.com:5000/ReportServer? using other environment variables i.e DATABASE_SERVER

Workaround

In your wkld manifest

variables:
  TEST1=https://${DATABASE_SERVER}:5000/ReportServer?
  DATABASE_SERVER=“example.com”

In order to achieve this

1. Create an entrypoint script entrypoint.sh: This script will export TEST1 using the current value of DATABASE_SERVER and then run your application.

#!/bin/sh
export TEST1="https://${DATABASE_SERVER}:5000/ReportServer?"

# Now execute the main process of the container

exec "$@"

2. Modify your Dockerfile

# Copy the entrypoint script into the container
COPY entrypoint.sh /entrypoint.sh
# Set the script as the entry point
ENTRYPOINT ["/entrypoint.sh"]
CMD ["your_application_start_command"]