Secrets should not be passed as container environment variables

How to fix it

Move each plain-text environment entry named after a credential into the container definition's secrets array, where valueFrom points at a Secrets Manager secret or an SSM parameter, and give the task execution role permission to read it. Rotate every credential that has sat in a task definition: each revision keeps it in plain text. This needs a new revision, with every service and scheduled task repointed at it.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

With Terraform

resource "aws_ecs_task_definition" "this" {
  family             = "example"
  execution_role_arn = aws_iam_role.task_execution.arn

  container_definitions = jsonencode([{
    name  = "app"
    image = var.container_image
    secrets = [{
      name      = "PASSWORD"
      valueFrom = aws_secretsmanager_secret.db_password.arn
    }]
  }])
}