In ECS you can store them in the task definitions which is easy but might not be secure enough in certain situations. More robust is to read them in from the Parameter Store see https://aws.amazon.com/blogs/compute/managing-secrets-for-am...