```RUN export PREFECT CONTEXT SECRETS AWS CREDENTIALS=$ echo

Question

```RUN export PREFECT CONTEXT SECRETS AWS CREDENTIALS=$ echo ` aws secretsmanager get secret value secret id $ prefect aws secret name region $ region | jq r SecretString ` ``` I m having a ton of trouble using ARG ENV RUN with a dockerfile what I want is for PREFECT CONTEXT SECRETS AWS CREDENTIALS to show up as an env variable in the final image Does anyone have experience setting env variables in a dockerfile from command output

Kevin Kho · Answer

I haven t tried this Do you get an ENV variable or no env variable at all Are you using ECS run

Kevin Kho · Answer

What is the use case here Cuz you can just give a role to the container and then you bypass this

chicago-joe · Answer

Depending on whether I have ENV set before or after the RUN command I will get an ENV variable but it is either blank or equal to the string PREFECT CONTEXT SECRETS AWS CREDENTIALS

chicago-joe · Answer

this dockerfile is built using ecs and I can verify that it is able to pull the secrets from secretsmanager The trouble is having the secret stay as an env variable in the final image The use case is that I m a developer and I want to debug a script locally my script uses one or more of the Prefect AWS Tasks but I m unable to authenticate because of the missing env variable

chicago-joe · Answer

we don t want to use ~ aws credentials anything hardcoded into a file

Kevin Kho · Answer

I personally can t see anything wrong with the attempt based on <https stackoverflow com a 37860420 11163214|this>

Marcin Grzybowski · Answer

maybe a better way is to provide envs in run docker e or in docker compose not to hardcode it into dockerfile which usually is pushed into repo

chicago-joe · Answer

would i be able to provide the aws secretsmanager command using e

Kevin Kho · Answer

I don t think so from the Prefect CLI

Anna Geller · Answer

Marcin gave a great suggestion and I would go even as far as saying that you shouldn t use AWS key pair for anything else other than local development for local development you can mount your home aws folder to your root container folder And for production you should use IAM roles instead

chicago-joe · Answer

< Dave Thomas> < Anna Geller> agreed but we d like to access the key pair using aws secretsmanager inside the image rather than distributing different key pairs to each dev user individually

Anna Geller · Answer

in that case for development you should bind mount the credential file for production you should assign the IAM role allowing secrets manager access

Anna Geller · Answer

Joe I just wrote a Discourse topic for you showing how to do it <https discourse prefect io t how to bind mount a volume to a flow run container for example mounting a volume with aws credentials to a docker agent 595|https discourse prefect io t how to bind mount a volume to a flow run container for e unting a volume with aws credentials to a docker agent 595>

Anna Geller · Answer

the easiest is by attaching it to your Docker agent ```prefect agent docker start label AGENT LABEL volume ~ aws root aws```

Anna Geller · Answer

definitely as < Marcin Grzybowski> correctly mentioned baking the credentials directly into the image would be a security risk but mounting as shown here would be a slightly better approach as you wouldn t risk those credentials would be baked into image directly and pushed to some registry