DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

LAB – AWS Secrets Manager & CloudWatch Logs

Goal

Today you will learn how real companies keep passwords secure and how DevOps engineers troubleshoot applications running in Amazon ECS.

By the end of this lab you will:

  • Store a database password in AWS Secrets Manager.
  • Connect your ECS application to the secret.
  • Configure CloudWatch Logs.
  • View application logs.
  • Understand how DevOps engineers troubleshoot production issues.

Part 1 – Why do we need AWS Secrets Manager?

Imagine your application needs to connect to a database.

Most beginners write something like this:

DB_HOST=mydatabase.amazonaws.com
DB_USER=admin
DB_PASSWORD=Password123
Enter fullscreen mode Exit fullscreen mode

This works, but it is not secure.

If you push this file to GitHub, anyone who can access the repository could see the password. If an employee leaves the company, the password might also be shared accidentally.

In production

Large companies never store passwords inside:

  • GitHub repositories
  • Docker images
  • Source code
  • Terraform files

Instead, passwords are stored in AWS Secrets Manager.

The application asks AWS for the password when it starts.

Application

↓

AWS Secrets Manager

↓

Returns Password
Enter fullscreen mode Exit fullscreen mode

This means:

  • Developers cannot accidentally expose passwords.
  • Passwords can be changed without changing application code.
  • Access is controlled using IAM permissions.

Part 2 – Create a Secret

  1. Open the AWS Console.
  2. Search for Secrets Manager.
  3. Click Store a new secret.

Select:

  • Other type of secret

Add the following key/value pairs:

DB_HOST = your-database-endpoint
DB_USER = postgres
DB_PASSWORD = Password123
Enter fullscreen mode Exit fullscreen mode

Replace these values with your own if you are using an RDS database.

Click Next.

Secret name:

restaurant-app-secret
Enter fullscreen mode Exit fullscreen mode

Click Next until the secret is created.

Part 3 – Why do we give the secret a name?

Your application does not know the actual password.

Instead, it asks AWS:

"Please give me the secret called restaurant-app-secret."

This allows you to change the password later without changing your application code.

Part 4 – Connect ECS to the Secret

Open:

ECS → Task Definitions

Select your task definition.

Click:

Create new revision

Scroll to:

Container

Find the Environment section.

Choose:

Secrets

Click:

Add Secret

Fill in:

Secret name:

DB_PASSWORD
Enter fullscreen mode Exit fullscreen mode

Value from:

Choose

restaurant-app-secret
Enter fullscreen mode Exit fullscreen mode

Save the task definition.

Now update your ECS service to use the newest task definition revision.

Part 5 – Why do we update the Service?

The task definition is only a template.

Updating the ECS Service launches new containers using the latest task definition.

This is how changes are deployed in production.

Part 6 – Verify Everything Works

Open:

ECS → Cluster → Service → Tasks

Wait until the task status is:

Running
Enter fullscreen mode Exit fullscreen mode

If the task stops immediately, something is wrong.

This is when DevOps engineers begin troubleshooting.

Part 7 – CloudWatch Logs

Why do we need CloudWatch Logs?

Imagine a developer says:

"The application doesn't work."

That message is not enough.

A DevOps engineer needs to answer:

  • Did the application start?
  • Did it crash?
  • Why did it crash?
  • Is the database reachable?
  • Did the application receive traffic?

CloudWatch Logs answers these questions.

Part 8 – Configure CloudWatch Logs

When creating or updating your task definition, locate the Log configuration section.

Select:

Log driver

awslogs
Enter fullscreen mode Exit fullscreen mode

Fill in:

Log group

/ecs/restaurant-app
Enter fullscreen mode Exit fullscreen mode

Region

us-east-1
Enter fullscreen mode Exit fullscreen mode

Stream prefix

ecs
Enter fullscreen mode Exit fullscreen mode

Save the task definition.

Deploy the new revision.

Part 9 – View Logs

Open:

CloudWatch

↓

Log Groups

↓

/ecs/restaurant-app
Enter fullscreen mode Exit fullscreen mode

↓

Open the newest log stream.

You should see application output such as:

Application started

Server listening on port 3000

Connected to database
Enter fullscreen mode Exit fullscreen mode

If you see these messages, your container started successfully.

Part 10 – Common Production Errors

Example 1 

Database connection failed
Enter fullscreen mode Exit fullscreen mode

Possible causes:

  • Wrong password
  • Database is stopped
  • Security Group blocks access

Example 2 

Port already in use
Enter fullscreen mode Exit fullscreen mode

Possible cause:

Your application is listening on the wrong port.

Example 3 

Cannot find module
Enter fullscreen mode Exit fullscreen mode

Possible cause:

The Docker image is missing required files.

Part 11 – What does a DevOps engineer check first?

When a production incident happens, a typical workflow is:

  1. Check if the ECS service is running.
  2. Check if tasks are healthy.
  3. Open CloudWatch Logs.
  4. Read the first error message.
  5. Identify the root cause.
  6. Fix the issue.
  7. Redeploy if necessary.
  8. Verify the application is healthy.

Logs are often the fastest way to understand why an application failed.

Part 12 – Good Logging Practices

Applications should log useful information, including:

  • Application startup
  • Database connection status
  • API requests
  • Errors and exceptions
  • Unexpected shutdowns

Avoid logging:

  • Passwords
  • API keys
  • Access tokens
  • Sensitive customer data

Lab Checklist

Before finishing this lab, verify that you can:

  • Create a secret in AWS Secrets Manager.
  • Update an ECS Task Definition.
  • Attach a secret to an ECS container.
  • Deploy the new task definition.
  • Configure the awslogs log driver.
  • Find your Log Group.
  • Open the latest Log Stream.
  • Identify an application error using CloudWatch Logs.

Interview Questions

  1. Why should passwords not be stored in GitHub?
  2. What problem does AWS Secrets Manager solve?
  3. Why do we update the ECS Service after creating a new task definition revision?
  4. What is CloudWatch Logs used for?
  5. Where do you look first when an ECS task crashes?
  6. What is the difference between an ECS task and a task definition?
  7. What information should never appear in application logs?

Top comments (0)