Editing Openai/694ab010-3e7c-8000-b0e8-b98c22b7a063 (section)

==== ### ====

Hardcoding OPENAI_API_KEY in the ECS task definition “Environment variables” is insecure and hard to rotate.
Instead: store it in Secrets Manager and inject it at runtime as a container secret.

===== 1. AWS Console → Secrets Manager =====
# Click Store a new secret
# Select Other type of secret
# Under Key/value pairs: - Key: OPENAI_API_KEY - Value: (paste your key)
# Click Next
# Secret name: prod/ml-chatbot/openai
# (Optional) Description: “OpenAI key for ML Chatbot”
# Click Next
# Configure automatic rotation: - For OpenAI keys, rotation is usually manual (unless you build your own rotation Lambda). - Leave rotation disabled for now.
# Click Next
# Review → Store

You now have an ARN like:
arn:aws:secretsmanager:REGION:ACCOUNT:secret:prod/ml-chatbot/openai-xxxx

===== Your ECS task needs permissions to fetch that secret at runtime. =====
# AWS Console → IAM
# Click Roles
# Find your ECS task execution role used by your task definition - Often named like: ecsTaskExecutionRole or something created with your task
# Click the role
# Add permissions → Attach policies
# Attach (minimum required pattern): - If you want simplest learning approach: attach AWS managed policy <code>SecretsManagerReadWrite</code> (too broad for production, but easy) - Better (recommended) approach: attach a custom inline policy restricting to that one secret:

Click:
* Permissions tab → Add permissions → Create inline policy
* Choose JSON and paste:

<syntaxhighlight lang="json">{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadSpecificSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT:secret:prod/ml-chatbot/openai-*"
    }
  ]
}

</syntaxhighlight>
# Click Next
# Policy name: ReadMlChatbotOpenAISecret
# Click Create policy

: 

===== 1. AWS Console → ECS =====
# Go to Task definitions
# Click your task definition: ml-chatbot-task
# Click Create new revision
# Scroll to Container definitions → select your container → Edit
# Find section Secrets (NOT environment variables)
# Click Add secret - Name: OPENAI_API_KEY - ValueFrom: select your secret: - prod/ml-chatbot/openai - If it asks for a specific JSON key, pick OPENAI_API_KEY
# Remove the plaintext environment variable OPENAI_API_KEY if you previously set it.
# Click Update
# Scroll down → Create

===== 1. ECS → Clusters → ml-chatbot-cluster =====
# Services → select your service
# Click Update
# Under Task definition revision choose the latest revision
# Click Update
# Wait for new task to start and old one to stop.

===== 1. ECS → Cluster → Service → Tasks =====
# Click the running task
# Go to Logs (CloudWatch)
# Confirm no “missing OPENAI_API_KEY” warnings.
# Test the UI / API.