Short answer: update the key anywhere you run Prefect CLI/SDK commands (local dev machines and CI that runs prefect deploy). You do not need to update your ECS push work pool or running flow containers unless you’ve manually hardcoded a key there. Details for Prefect 3.x with an ECS push work pool: - What to update - Any environment that calls Prefect Cloud with your user/service API key: - Local dev: re-login or set the new key

prefect cloud login --key <NEW_KEY> --workspace <account>/<workspace>

or export it as

PREFECT_API_KEY

. - CI/CD: update the secret storing

PREFECT_API_KEY

(and ensure your pipeline logs in with it, e.g.

prefect cloud login --key $PREFECT_API_KEY --workspace <account>/<workspace>

). - Any automation using the Python client with your key. - What you generally do NOT need to update - Your ECS push work pool configuration or your deployments. For push pools, Prefect Cloud injects a short‑lived flow-run token into the ECS task at runtime, so your personal API key is not baked into the container. - Existing/running flow runs; they use an ephemeral per-run token that is minted when the run starts. Exceptions to check - If you’ve explicitly set

PREFECT_API_KEY

in: - The work pool’s job template env overrides, or - Your ECS task definition/container env then update that value too. Most users don’t set this manually for push pools. Helpful docs - Connect to Cloud: Connect to Prefect Cloud - API keys (create/rotate): Manage API keys - ECS push work pool guide: ECS guide If you’re deploying from CI, which provider are you using (GitHub Actions, GitLab, etc.)? I can share a minimal snippet for updating the secret and logging in. Also, have you added any custom env vars (like

PREFECT_API_KEY

) to your ECS job template?