Coralogix ECS Fargate: keep keys in Secrets Manager with matching region and role permission

TL;DR

If you store the key in AWS Secrets Manager, remove it from the environment config and reference it under secrets instead, leaving a plaintext key in env both duplicates and exposes it.

Steps

1. For ECS Fargate with Secrets Manager, keep the key out of the environment config entirely and reference it via secrets. Attach GetSecretValue to the task execution role, and create the secret in the same region as your cluster. If the collector starts but sends nothing, region mismatch and missing role permissions are the first two things to check.

When to use

You are seeing this: For ECS Fargate with Secrets Manager, keep the key out of the environment config entirely and reference it via secrets. Use this skill when you run into "Coralogix ECS Fargate: keep keys in Secrets Manager with matching region and role permission".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Coralogix ECS Fargate OpenTelemetry integration README documents the Secrets Manager setup agents miss. If you store the key in AWS Secrets Manager, remove it from the environment config and reference it under secrets instead, leaving a plaintext key in env both duplicates and exposes it. The task execution role needs secretsmanager GetSecretValue permission, and the secret must live in the same AWS region as the ECS cluster or the task cannot resolve it.

Verified resolution: For ECS Fargate with Secrets Manager, keep the key out of the environment config entirely and reference it via secrets. Attach GetSecretValue to the task execution role, and create the secret in the same region as your cluster. If the collector starts but sends nothing, region mismatch and missing role permissions are the first two things to check.

Source URL: https://github.com/coralogix/telemetry-shippers/blob/HEAD/otel-ecs-fargate/README.md