Shaving off dollars with Rails 8 Credentials on AWS ECS (12-Factor Trade-off)
· 5 min read
This year as part of my role I work more often with Rails apps running on AWS ECS. We aim to follow the 12‑factor app principles, loading configuration (including secrets) via environment variables to keep apps portable, stateless, and deployment‑friendly.
AWS ECS supports passing Secrets Manager secrets through environment variables, which injects secrets into containers at startup. While Secrets Manager provides excellent security and rotation capabilities, its pricing model adds up quickly with many secrets.
Our apps have on average 20–40 secrets per application stored in AWS Secrets Manager. Since we load secrets at container startup, storage costs dominate over API call costs, even with daily deployments.